CVE-2020-13452

Gotenberg <= 6.2.1 is affected by insecure permissions on tini (writable by the gotenberg user), enabling an attacker to overwrite files and potentially trigger denial of service or code execution. Vulnerability details are supported by multiple sources (e.g., Red Hat, CNVD, OSV, Veracode) and...

CVE-2020-13451

CVE-2020-13451 affects Gotenberg up to version 6.2.1. The issue is described as an incomplete-cleanup vulnerability in the Office rendering engine, enabling an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros. Connected documents corroborate the vulnerab...

CVE-2020-13450

CVE-2020-13450 concerns Gotenberg, a Docker-powered stateless API for document conversion. The vulnerability is a directory traversal in the file upload function, affecting versions up to 6.2.1 (and earlier per sources). An attacker can upload and overwrite any writable files outside the intended...

CVE-2026-42596

CVE-2026-42596 describes an unauthenticated SSRF vulnerability in Gotenberg’s default deny-list filtering for the downloadFrom and webhook features. The issue arises because the deny-lists are regex-based and case-sensitive, allowing attacker-controlled URLs (e.g., IPv4-mapped IPv6 loopback forms...

CVE-2026-42589

Gotenberg CVE-2026-42589: The issue is an unauthenticated remote code execution in Gotenberg

CVE-2026-35458

Gotenberg CVE-2026-35458 affects the Chromium module of Gotenberg (forms/chromium/screenshot/url) where user-supplied scope patterns are compiled with dlclark/regexp2 without a timeout, enabling ReDoS/backtracking that can hang workers and impact availability. Affected code paths and versions are...