290 matches found
CVE-2026-55229 Gotenberg: SSRF via LibreOffice document processing
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTPS resources and local file resources during document conversion, enabling bli...
GHSA-86M8-88FQ-XFXP vulnerabilities
Vulnerabilities for packages: gotenberg...
CVE-2026-45741 vulnerabilities
Vulnerabilities for packages: gotenberg...
GO-2026-5669 Gotenberg has a Race Condition via Multipart `downloadFrom` Handling in github.com/gotenberg/gotenberg
Gotenberg has a Race Condition via Multipart downloadFrom Handling in github.com/gotenberg/gotenberg...
GO-2026-5636 Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg
Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg...
GO-2026-5572 Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix) in github.com/gotenberg/gotenberg
Gotenberg has ExifTool stdin argument injection via metadata value newlines bypass of key sanitization fix in github.com/gotenberg/gotenberg...
GO-2026-5587 Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags in github.com/gotenberg/gotenberg
Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags in github.com/gotenberg/gotenberg...
GO-2026-5627 Gotenberg has a Server-Side Request Forgery (SSRF) Issue in github.com/gotenberg/gotenberg
Gotenberg has a Server-Side Request Forgery SSRF Issue in github.com/gotenberg/gotenberg...
GO-2026-5443 Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg
Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg...
GO-2026-5324 Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass in github.com/gotenberg/gotenberg
Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass in github.com/gotenberg/gotenberg...
GO-2026-5372 Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature in github.com/gotenberg/gotenberg
Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature in github.com/gotenberg/gotenberg...
GO-2026-5395 Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme in github.com/gotenberg/gotenberg
Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme in github.com/gotenberg/gotenberg...
GO-2026-5244 Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes in github.com/gotenberg/gotenberg
Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes in github.com/gotenberg/gotenberg...
GO-2026-5234 Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist in github.com/gotenberg/gotenberg
Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist in github.com/gotenberg/gotenberg...
GO-2026-5162 Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move in github.com/gotenberg/gotenberg
Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move in github.com/gotenberg/gotenberg...
GO-2026-5155 Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL in github.com/gotenberg/gotenberg
Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL in github.com/gotenberg/gotenberg...
GO-2026-5151 Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection in github.com/gotenberg/gotenberg
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection in github.com/gotenberg/gotenberg...
GO-2026-5132 Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook in github.com/gotenberg/gotenberg
Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook in github.com/gotenberg/gotenberg...
VulnCheck KEV: CVE-2026-42589
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded i...