CVE-2026-55229

Published: Jul 10, 2026Modified: Jul 13, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in version 8.34.0.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://github.com/gotenberg/gotenberg/commit/98fc40347885ad510a311b990a73397c6d4143db

Source: security-advisories@github.com

https://github.com/gotenberg/gotenberg/releases/tag/v8.34.0

Source: security-advisories@github.com

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2mrg-35hw-x3x9

Source: security-advisories@github.com

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2mrg-35hw-x3x9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.