gotenberg

Records26All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

gotenberg records in CISA KEV

No gotenberg vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Gotenberg 22 records HIGH

Records

26 records

TI-2026-30869 CVE-2026-42589 · GHSA-rqgh-gxv4-6657

Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection

HIGH 82

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03013 Published 2026-05-14 Fixed in 8.31.0 CWE-78

TI-2026-29063 CVE-2026-40281 · GHSA-q7r4-hc83-hf2q

Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

HIGH 82

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02258 Published 2026-05-06 Fixed in 8.31.0 CWE-88

TI-2026-30876 CVE-2026-42596 · GHSA-4vmc-gm8v-m35h

Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

HIGH 80

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.01589 Published 2026-05-14 Fixed in 8.31.0, 8.32.0 CWE-918

TI-2026-27588 CVE-2026-35458 · GHSA-fmwg-qcqh-m992

Gotenberg has a ReDoS via extraHttpHeaders scope feature

HIGH 79

Gotenberg is an API for converting document formats.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00517 Published 2026-04-07 Fixed in 8.30.0 CWE-1333

TI-2026-30875 CVE-2026-42595 · GHSA-chwh-f6gm-r836

Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass

HIGH 76

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00313 Published 2026-05-14 Fixed in 8.32.0 CWE-918

TI-2026-30871 CVE-2026-42591 · GHSA-rm4c-xj6x-49mw

Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8

HIGH 75

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00253 Published 2026-05-14 Fixed in 8.32.0 CWE-918

TI-2026-30870 CVE-2026-42590 · GHSA-7v3r-m9c8-r855

Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist

HIGH 75

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0029 Published 2026-05-14 Fixed in 8.30.0 CWE-184

TI-2026-29549 CVE-2026-40893 · GHSA-62p3-hvxx-fxg4

Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move

HIGH 75

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00347 Published 2026-05-14 Fixed in 8.31.0 CWE-184

TI-2026-29062 CVE-2026-40280 · GHSA-5q7p-7jgv-ww56

Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists

HIGH 73

Gotenberg is an API-based document conversion tool.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.0195 Published 2026-05-05 Fixed in 8.31.0 CWE-918

TI-2026-21492 CVE-2026-27018 · GHSA-jjwv-57xh-xr6r

Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme

HIGH 73

Gotenberg is an API for converting document formats.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.01701 Published 2026-03-30 Fixed in 8.29.0 CWE-22

TI-2026-39906 CVE-2026-55229 · GHSA-2mrg-35hw-x3x9

Gotenberg: SSRF via LibreOffice document processing

HIGH 72

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01514 Published 2026-07-10 Fixed in 8.34.0 CWE-918

TI-2026-33479 CVE-2026-45742 · GHSA-vp73-vjw8-8f32

Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

HIGH 72

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00705 Published 2026-08-19 Fixed in 8.33.0 CWE-362

TI-2026-30874 CVE-2026-42594 · GHSA-r33j-c622-r6qp

Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine

HIGH 72

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00348 Published 2026-05-14 Fixed in 8.32.0 CWE-362

TI-2026-28368 CVE-2026-39383 · GHSA-5vh4-rgv7-p9g4

Gotenberg unauthenticated blind SSRF via unfiltered webhook URL

HIGH 70

Gotenberg is an API-based document conversion tool.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00236 Published 2026-05-05 Fixed in 8.31.0 CWE-918

TI-2026-33478 CVE-2026-45741 · GHSA-86m8-88fq-xfxp

Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

HIGH 66

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00372 Published 2026-08-19 Fixed in 8.33.0 CWE-184

TI-2026-30873 CVE-2026-42593 · GHSA-3cv5-q585-h563

Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes

MEDIUM 63

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00311 Published 2026-05-14 Fixed in 8.32.0 CWE-22

TI-2026-30872 CVE-2026-42592 · GHSA-2pmr-289p-44r3

Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

MEDIUM 63

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00192 Published 2026-05-14 Fixed in 8.32.0 CWE-367

TI-2026-30877 CVE-2026-42597 · GHSA-g924-cjx7-2rjw

Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme

MEDIUM 60

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00277 Published 2026-05-14 Fixed in 8.32.0 CWE-73

TI-2020-10549 CVE-2020-13450 · GHSA-rcq3-m33j-rj5c

A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1…

MEDIUM 51

A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05831 Published 2021-01-07 No fix listed CWE-22

TI-2020-10550 CVE-2020-13451 · GHSA-wcf9-3wr2-8wmf

An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through…

MEDIUM 48

An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03151 Published 2021-01-07 No fix listed CWE-459

TI-2020-10551 CVE-2020-13452 · GHSA-p869-hg26-w7c6

In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg)…

MEDIUM 47

In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02865 Published 2021-01-07 No fix listed CWE-276

TI-2020-10548 CVE-2020-13449 · GHSA-7c9w-2w99-hrrm

A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1…

MEDIUM 41

A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04996 Published 2021-01-07 No fix listed CWE-22

TI-2026-32711 CVE-2026-44829 · GHSA-hwc4-gmrw-5222

Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename

LOW 39

Gotenberg is a Docker-powered stateless API for PDF files.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00503 Published 2026-08-19 Fixed in 8.33.0 CWE-22

TI-2020-11087 CVE-2020-14160 · GHSA-4f9m-6h5h-cg9v

An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF…

LOW 36

An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01695 Published 2021-08-26 No fix listed CWE-918

TI-2020-11088 CVE-2020-14161 · GHSA-xr25-82p4-842w

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in…

LOW 29

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00902 Published 2021-08-26 No fix listed CWE-79

Open these records in search →

Critical	6
High	14
Medium	6
Low	0
No CVSS	0