Is CVE-2026-55229 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55229 being exploited in the wild.

How severe is CVE-2026-55229?

High severity, with a CVSS score of 7.5, published 10 July 2026.

Which products and versions are affected?

github.com/gotenberg/gotenberg/v7 (Go) SEMVER:introduced=0; github.com/gotenberg/gotenberg/v8 (Go) < 8.34.0, SEMVER:introduced=0,fixed=8.34.0; Gotenberg < 8.34.0.

Is there a fix for CVE-2026-55229?

Yes. github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.34.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55229 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55229?

Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55229: Gotenberg SSRF and local file disclosure in LibreOffice conversion

Q: Is there a fix for CVE-2026-55229?

Yes. github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.34.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55229 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55229?

Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55229 · Severity: high · CVSS 7.5 · Published 2026-07-10

Gotenberg is a tool used to convert various document formats into PDF files. A security flaw in its document conversion process allows an attacker to upload a specially crafted file that forces the server to make unauthorized network requests or read local files. This could lead to the exposure of internal network information or sensitive files stored on the server.

Technologies: github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go), Gotenberg. Vendors: Go, Gotenberg.

Quick answers

Is CVE-2026-55229 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55229 being exploited in the wild.
How severe is CVE-2026-55229?: High severity, with a CVSS score of 7.5, published 10 July 2026.
Which products and versions are affected?: github.com/gotenberg/gotenberg/v7 (Go) SEMVER:introduced=0; github.com/gotenberg/gotenberg/v8 (Go) < 8.34.0, SEMVER:introduced=0,fixed=8.34.0; Gotenberg < 8.34.0.
Is there a fix for CVE-2026-55229?: Yes. github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.34.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55229 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55229?: Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.34.0 or later
```
go get github.com/gotenberg/gotenberg/v8@v8.34.0
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Gotenberg's /forms/libreoffice/convert endpoint due to insufficient restrictions on linked resources during document conversion. An attacker can submit a document (e.g., DOCX) containing tags that reference external HTTP(S) URLs or local file paths. LibreOffice, acting as the conversion engine, automatically retrieves these resources, leading to blind SSRF or the embedding of local image files into the resulting PDF. The root cause was the lack of the 'BlockUntrustedRefererLinks' configuration in the LibreOffice profile. This issue is resolved in version 8.34.0 by blocking content linked from untrusted locations.

Affected products

Gotenberg Gotenberg < 8.34.0

Identifiers

CVE-2026-55229
GHSA-2mrg-35hw-x3x9
GO-2026-5060

Timeline

2026-06-11: patched: Fix committed to repository
2026-06-12: advisory: Release 8.34.0 published
2026-07-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.