CVE-2026-42591

8.2 Élevée

Publiée le 14/05/2026 à 18:16 · Modifiée le 17/06/2026 à 12:48 · Analysée par le NVD · Source : security-advisories@github.com

Description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely bypassing the SSRF filters. This vulnerability is fixed in 8.32.0.

Traduire en français

Produits concernés

gotenberg
Thecodingmachine gotenberg

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.2 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rm4c-xj6x-49mw ExploitVendor Advisory
https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rm4c-xj6x-49mw ExploitVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories