Remote File Access Vulnerability in Gotenberg PDF API

CVE-2026-42597

What is CVE-2026-42597?

An access control vulnerability in Gotenberg allows unauthorized users to exploit specific routes in the API. Prior to version 8.32.0, the /forms/chromium/convert/url and /forms/chromium/screenshot/url endpoints accepted 'file:///tmp/...' URLs from unauthenticated users. This issue arises because the default Chromium deny-list exemption for 'file:///tmp/' permits loading local assets, yet the corresponding routes lack an 'AllowedFilePrefixes' guard. This oversight lets attackers enumerate and access raw source files from other ongoing conversions, posing significant security risks.

References