CVE-2026-126799

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6...