Vulnerabilities CVE-2026-42591

CVE-2026-42591

High

Open

TLP:CLEAR

Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely bypassing the SSRF filters. This vulnerability is fixed in 8.32.0.

Details

CVSS Score: 8.2
EPSS Score ⓘ: 0.25%

16.8th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Confidence: 90%
Published: May 14, 2026
Last Modified: May 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.