SSR Vulnerability in Gotenberg API for PDF Files
CVE-2026-42595

8.6HIGH

Key Information:

Vendor

Gotenberg

Status
Gotenberg
Vendor
CVE Published:
14 May 2026

What is CVE-2026-42595?

Gotenberg, a Docker-powered stateless API for handling PDF files, has a vulnerability in its Chromium URL-to-PDF endpoint that lacks sufficient protection against Server-Side Request Forgery (SSRF). Before version 8.32.0, the system's default deny-list regex only prevents access to file:// URIs, enabling unauthenticated attackers to target internal IP addresses—including loopback and RFC 1918 ranges—by rendering responses as PDFs. This oversight allows attackers to exploit 302 redirects from an external URL to access internal resources without appropriate validation against the deny-list, compromising internal systems. Users are advised to upgrade to version 8.32.0 or later to mitigate this risk.

Affected Version(s)

gotenberg < 8.32.0

References

https://github.com/gotenberg/gotenberg/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.