gotenberg vulnerabilities

Newest CVEs

• CVE-2026-44829

  Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename

  gotenberg · gotenberg

  High8.8
• CVE-2026-45742

  Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  gotenberg · gotenberg

  High7.5
• CVE-2026-45741

  Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

  gotenberg · gotenberg

  High7.5
• CVE-2026-55229

  Gotenberg: SSRF via LibreOffice document processing

  gotenberg · gotenberg

  High7.5
• CVE-2026-42590

  Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist

  gotenberg · gotenberg

  High8.2
• CVE-2026-42597

  Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme

  gotenberg · gotenberg

  Medium5.9
• CVE-2026-42595

  Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass

  gotenberg · gotenberg

  High8.6
• CVE-2026-42594

  Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine

  gotenberg · gotenberg

  High7.5
• CVE-2026-42593

  Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes

  gotenberg · gotenberg

  Medium5.3
• CVE-2026-42592

  Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

  gotenberg · gotenberg

  Medium5.3