TI-2026-32711 CVE-2026-44829 · GHSA-hwc4-gmrw-5222
Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename
Priority LOW 39
Gotenberg is a Docker-powered stateless API for PDF files.
Vulnerabilities
26 records
TI-2026-33479 CVE-2026-45742 · GHSA-vp73-vjw8-8f32
Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Priority HIGH 72
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-33478 CVE-2026-45741 · GHSA-86m8-88fq-xfxp
Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes
Priority HIGH 66
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-39906 CVE-2026-55229 · GHSA-2mrg-35hw-x3x9
Gotenberg: SSRF via LibreOffice document processing
Priority HIGH 72
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-30870 CVE-2026-42590 · GHSA-7v3r-m9c8-r855
Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist
Priority HIGH 75
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-30877 CVE-2026-42597 · GHSA-g924-cjx7-2rjw
Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme
Priority MEDIUM 60
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-30875 CVE-2026-42595 · GHSA-chwh-f6gm-r836
Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
Priority HIGH 76
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-30874 CVE-2026-42594 · GHSA-r33j-c622-r6qp
Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine
Priority HIGH 72
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-30873 CVE-2026-42593 · GHSA-3cv5-q585-h563
Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes
Priority MEDIUM 63
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-30872 CVE-2026-42592 · GHSA-2pmr-289p-44r3
Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes
Priority MEDIUM 63
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-30871 CVE-2026-42591 · GHSA-rm4c-xj6x-49mw
Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8
Priority HIGH 75
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-30876 CVE-2026-42596 · GHSA-4vmc-gm8v-m35h
Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
Priority HIGH 80
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-29549 CVE-2026-40893 · GHSA-62p3-hvxx-fxg4
Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move
Priority HIGH 75
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-30869 CVE-2026-42589 · GHSA-rqgh-gxv4-6657
Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
Priority HIGH 82
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-29063 CVE-2026-40281 · GHSA-q7r4-hc83-hf2q
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
Priority HIGH 82
Gotenberg is a Docker-powered stateless API for PDF files.
TI-2026-28368 CVE-2026-39383 · GHSA-5vh4-rgv7-p9g4
Gotenberg unauthenticated blind SSRF via unfiltered webhook URL
Priority HIGH 70
Gotenberg is an API-based document conversion tool.
TI-2026-29062 CVE-2026-40280 · GHSA-5q7p-7jgv-ww56
Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists
Priority HIGH 73
Gotenberg is an API-based document conversion tool.
TI-2026-27588 CVE-2026-35458 · GHSA-fmwg-qcqh-m992
Gotenberg has a ReDoS via extraHttpHeaders scope feature
Priority HIGH 79
Gotenberg is an API for converting document formats.
TI-2026-21492 CVE-2026-27018 · GHSA-jjwv-57xh-xr6r
Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme
Priority HIGH 73
Gotenberg is an API for converting document formats.
TI-2020-11087 CVE-2020-14160 · GHSA-4f9m-6h5h-cg9v
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF…
Priority LOW 36
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources.
TI-2020-11088 CVE-2020-14161 · GHSA-xr25-82p4-842w
It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in…
Priority LOW 29
It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint.
TI-2021-06043 CVE-2021-23345 · GHSA-r97h-mg64-mcjr
Server-side request forgery (SSRF) in github.com/thecodingmachine/gotenberg
Priority LOW 26
All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system fil…
TI-2020-10548 CVE-2020-13449 · GHSA-7c9w-2w99-hrrm
A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1…
Priority MEDIUM 41
A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files.
TI-2020-10549 CVE-2020-13450 · GHSA-rcq3-m33j-rj5c
A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1…
Priority MEDIUM 51
A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder.
TI-2020-10550 CVE-2020-13451 · GHSA-wcf9-3wr2-8wmf
An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through…
Priority MEDIUM 48
An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros.