Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Gotenberg may let attackers reach internal network

CVE-2026-55229 · published 3 months ago
Summary

The Gotenberg service that converts documents to PDF can be sent a specially crafted file that makes LibreOffice fetch resources from any web address or local file path. This could allow an attacker to probe internal systems or read limited local files. Upgrade Gotenberg to version 8.34.0 or later to stop this behavior.

What to do
  • Update github.com gotenberg to version 8.34.0.
Affected software
Ecosystem VendorProductAffected versions
go github.com gotenberg < 8.34.0
Fix: upgrade to 8.34.0
– gotenberg gotenberg < 8.34.0
Original advisory text
Gotenberg: SSRF via LibreOffice document processing
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in version 8.34.0.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published10 Jul 2026
Updated31 Oct 2026
First seen18 Jun 2026
Sources
GHSA-2mrg-35hw-x3x9 · GHSA
CVE-2026-55229 · NVD
CVE-2026-55229 · MITRE
CVE-2026-55229 · OSV
Track software like this
Free during beta