CVE-2026-55229

7.5 Élevée

Publiée le 10/07/2026 à 23:16 · Modifiée le 13/07/2026 à 21:21 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in version 8.34.0.

Traduire en français

Produits concernés

gotenberg

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/gotenberg/gotenberg/commit/98fc40347885ad510a311b990a73397c6d4143db
https://github.com/gotenberg/gotenberg/releases/tag/v8.34.0
https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2mrg-35hw-x3x9
https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2mrg-35hw-x3x9

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories