1509 matches found
CVE-2026-42593: Improper Limitation of a Pathname to a Restricted Directory
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfengines/split, libreoffice/convert, chromium/convert/url, chromium/convert/html, and chromium/convert/markdown accept stampSource=pdf + stampExpression=/path and watermarkSource=pdf +...
CVE-2026-42591: Server-Side Request Forgery (SSRF)
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint /forms/libreoffice/convert passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely...
OPENSUSE-SU-2026:20745-1 Security update for php8
This update for php8 fixes the following issues - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection bsc1264778. - CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in...
stb-image-cwe190-poc
PoC — stbimage v2.30 stbiconvertformat16 integer overf...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the convertUrlRoute and screenshotUrlRoute processes. An attacker can access sensitive files belonging to other users' in-flight conversion requests by submitting specially crafted file:// URLs pointi...
Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes
Summary Six conversion routes pdfengines/merge, pdfengines/split, libreoffice/convert, chromium/convert/url, chromium/convert/html, chromium/convert/markdown accept stampSource=pdf + stampExpression=/path and watermarkSource=pdf + watermarkExpression=/path from anonymous callers. The dedicated...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the stampExpression and watermarkExpression parameters in the merge, split, and convert routes. An attacker can access the contents of arbitrary PDF files on the server by supplying a path to a...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the stampExpression and watermarkExpression parameters in the merge, split, and convert routes. An attacker can access the contents of arbitrary PDF files on the server by supplying a path to a...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the stampExpression and watermarkExpression parameters in the merge, split, and convert routes. An attacker can access the contents of arbitrary PDF files on the server by supplying a path to a...
PT-2026-38382
Name of the Vulnerable Software and Affected Versions Gotenberg versions 8.31.0 and earlier Description A Server-Side Request Forgery SSRF issue exists in the LibreOffice conversion endpoint "/forms/libreoffice/convert". While some SSRF hardening is present in the Go code, the application passes...
convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-40110 via jupyter-server (1.13.2)
jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-40110 Source advisory:...
convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-40934 via jupyter-server (1.13.2)
jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-40934 Source advisory: OSV:PYSEC-2026...
convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-35397 via jupyter-server (1.13.2)
jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-35397 Source advisory: OSV:PYSEC-2026...
convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-40934 via jupyter-server (1.13.2)
jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-40934 Source advisory:...
convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-35397 via jupyter-server (1.13.2)
jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-35397 Source advisory:...
convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2025-61669 via jupyter-server (1.13.2)
jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2025-61669 Source advisory:...
convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2025-61669 via jupyter-server (1.13.2)
jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2025-61669 Source advisory: OSV:PYSEC-2026...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the FBXConverter::ConvertMeshMultiMaterial process. An attacker can cause the application to crash or become unresponsive by submitting specially crafted input files. Remediation There is no fixed version for...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the ConvertMeshMultiMaterial process in FBXConverter.cpp. An attacker can trigger application termination or resource exhaustion by submitting specially crafted input files. Remediation There is no fixed version fo...