CVE-2024-21527

🗓️ 19 Jul 2024 05:00:04Reported by snykType

cve🔗 web.nvd.nist.gov👁 56 Views🌐 WEB

Versions of gotenberg package before 8.1.0 are vulnerable to SSRF via localhost. Attackers can achieve local file inclusion

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2024-21527	19 Jul 202405:15	–	attackerkb
ATTACKERKB	CVE-2026-27018	30 Mar 202620:14	–	attackerkb
Circl	CVE-2024-21527	19 Jul 202407:50	–	circl
Cvelist	CVE-2024-21527	19 Jul 202405:00	–	cvelist
EUVD	EUVD-2024-19196	3 Oct 202520:07	–	euvd
Github Security Blog	Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)	30 Mar 202616:16	–	github
NVD	CVE-2024-21527	19 Jul 202405:15	–	nvd
OSV	CVE-2024-21527	19 Jul 202405:00	–	osv
OSV	GO-2024-2996 CVE-2024-21527 in github.com/gotenberg/gotenberg	22 Jul 202418:24	–	osv
Positive Technologies	PT-2024-18941	19 Jul 202400:00	–	ptsecurity

[
  {
    "product": "github.com/gotenberg/gotenberg/v8/pkg/gotenberg",
    "versions": [
      {
        "version": "0",
        "lessThan": "8.1.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "github.com/gotenberg/gotenberg/v8/pkg/modules/chromium",
    "versions": [
      {
        "version": "0",
        "lessThan": "8.1.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "github.com/gotenberg/gotenberg/v8/pkg/modules/webhook",
    "versions": [
      {
        "version": "0",
        "lessThan": "8.1.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
github	www.github.com/gotenberg/gotenberg/releases/tag/v8.1.0
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGGOTENBERG-7537081
gist	www.gist.github.com/filipochnik/bc88a3d1cc17c07cec391ee98e1e6356
github	www.github.com/gotenberg/gotenberg/commit/ad152e62e5124b673099a9103eb6e7f933771794
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGMODULESCHROMIUM-7537082
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGMODULESWEBHOOK-7537083

Parameter	Position	Path	Description	CWE
iframe src	request body	/convert/html	SSRF via /convert/html allowing local file inclusion when HTML references localhost resources.	CWE-918
HTML content	request body	/convert/html	SSRF via /convert/html allowing local file inclusion when HTML references localhost resources.	CWE-918

08 Jul 2026 15:25Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.18.2

CVSS 48.8

EPSS0.00574

SSVC

CWE-918