CVE-2026-27018 Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme

What is CVE-2026-27018?

CVE-2026-27018 is a high-severity server-side request forgery vulnerability in gotenberg, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Gotenberg is an API for converting document formats. Prior to version 8.29.0, the fix introduced for CVE-2024-21527 can be bypassed using mixed-case or uppercase URL schemes. This issue has been patched in version 8.29.0.

Weakness: CWE-918, CWE-22

Which versions are affected by CVE-2026-27018?

6 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v7 and github.com/gotenberg/gotenberg/v8. It affects 1 product.

Products include Thecodingmachine Gotenberg.

How do I fix CVE-2026-27018?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-27018 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27018 exists.

Other vulnerabilities in gotenberg

• CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values Critical 10.0
• CVE-2026-42589 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection Critical 9.8
• CVE-2020-13450 Path traversal in n/a Critical 9.8
• CVE-2020-13451 Code injection in n/a Critical 9.8
• CVE-2020-13452 Privilege escalation in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jjwv-57xh-xr6r, GO-2026-4905.