# CVE-2026-55229: Gotenberg SSRF and local file disclosure in LibreOffice conversion

Source: https://junglewise.ai/threats/cve-2026-55229-gotenberg-ssrf-and-local-file-disclosure-in-libreoffice  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55229 · Severity: high · CVSS 7.5 · Published 2026-07-10

Gotenberg is a tool used to convert various document formats into PDF files. A security flaw in its document conversion process allows an attacker to upload a specially crafted file that forces the server to make unauthorized network requests or read local files. This could lead to the exposure of internal network information or sensitive files stored on the server.

Technologies: [github.com/gotenberg/gotenberg/v7 (Go)](https://junglewise.ai/threats/technologies/github-com-gotenberg-gotenberg-v7), [github.com/gotenberg/gotenberg/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-gotenberg-gotenberg-v8), [Gotenberg](https://junglewise.ai/threats/technologies/gotenberg). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Gotenberg](https://junglewise.ai/threats/vendors/gotenberg).

## Quick answers

**Is CVE-2026-55229 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55229 being exploited in the wild.

**How severe is CVE-2026-55229?** High severity, with a CVSS score of 7.5, published 10 July 2026.

**Which products and versions are affected?** github.com/gotenberg/gotenberg/v7 (Go) SEMVER:introduced=0; github.com/gotenberg/gotenberg/v8 (Go) < 8.34.0, SEMVER:introduced=0,fixed=8.34.0; Gotenberg < 8.34.0.

**Is there a fix for CVE-2026-55229?** Yes. github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.34.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55229 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55229?** Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.34.0 or later

  ```sh
  go get github.com/gotenberg/gotenberg/v8@v8.34.0
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Gotenberg's /forms/libreoffice/convert endpoint due to insufficient restrictions on linked resources during document conversion. An attacker can submit a document (e.g., DOCX) containing tags that reference external HTTP(S) URLs or local file paths. LibreOffice, acting as the conversion engine, automatically retrieves these resources, leading to blind SSRF or the embedding of local image files into the resulting PDF. The root cause was the lack of the 'BlockUntrustedRefererLinks' configuration in the LibreOffice profile. This issue is resolved in version 8.34.0 by blocking content linked from untrusted locations.

## Affected products

- Gotenberg Gotenberg < 8.34.0

## Identifiers

- CVE-2026-55229
- GHSA-2mrg-35hw-x3x9
- GO-2026-5060

## Timeline

- 2026-06-11: patched: Fix committed to repository
- 2026-06-12: advisory: Release 8.34.0 published
- 2026-07-10: disclosed: CVE published to NVD

## References

- [https://github.com/gotenberg/gotenberg/commit/98fc40347885ad510a311b990a73397c6d4143db](https://github.com/gotenberg/gotenberg/commit/98fc40347885ad510a311b990a73397c6d4143db)
- [https://github.com/gotenberg/gotenberg/releases/tag/v8.34.0](https://github.com/gotenberg/gotenberg/releases/tag/v8.34.0)
- [https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2mrg-35hw-x3x9](https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2mrg-35hw-x3x9)

## Related threats

- [Gotenberg server-side request forgery in IsPublicIP IPv6 handling](https://junglewise.ai/threats/cve-2026-126799-gotenberg-8-31-0-before-8-38-0-contains-a-server-side-request)
- [Gotenberg race condition in multipart downloadFrom handling](https://junglewise.ai/threats/cve-2026-45742-gotenberg-race-condition-in-multipart-downloadfrom-handling)
- [Gotenberg SSRF deny-list bypass in IsPublicIP via IPv6 prefixes](https://junglewise.ai/threats/cve-2026-45741-gotenberg-ssrf-deny-list-bypass-in-ispublicip-via-ipv6-prefixes)
- [Gotenberg path traversal via Windows-style separators in ZIP entry names](https://junglewise.ai/threats/cve-2026-44829-gotenberg-path-traversal-via-windows-style-separators-in-zip)
- [GO-2026-5587 - Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing…](https://junglewise.ai/threats/go-2026-5587-gotenberg-has-incomplete-fix-for-exiftool-arbitrary-file-5b46f3f0)