CVE-2020-14160 Server-side request forgery in n/a

What is CVE-2020-14160?

CVE-2020-14160 is a high-severity server-side request forgery vulnerability in n/a, published on 26 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources.

Weakness: CWE-918

Which versions are affected by CVE-2020-14160?

It affects 1 product.

Products include Thecodingmachine Gotenberg.

How do I fix CVE-2020-14160?

No fix has been published for CVE-2020-14160 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2020-14160 being exploited?

There is no known exploitation of CVE-2020-14160 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values Critical 10.0
• CVE-2026-42589 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection Critical 9.8
• CVE-2020-13450 Path traversal in n/a Critical 9.8
• CVE-2020-13451 Code injection in n/a Critical 9.8
• CVE-2020-13452 Privilege escalation in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4f9m-6h5h-cg9v.