CVE-2026-42591CWE-918

Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8

High · published May 14, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
27.3
In the wild
Unconfirmed
What it is

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely bypassing the SSRF filters. This vulnerability is fixed in 8.32.0.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-14T15:20Z
EPSS history
Timeline
  • 14 MAY 15:20Z
    Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8
    cvelistv5