CVE-2026-42591 Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8

What is CVE-2026-42591?

CVE-2026-42591 is a high-severity server-side request forgery vulnerability in gotenberg, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely bypassing the SSRF filters. This vulnerability is fixed in 8.32.0.

Weakness: CWE-918

Which versions are affected by CVE-2026-42591?

4 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v8 and github.com/gotenberg/gotenberg/v7. It affects 1 product.

Products include Thecodingmachine Gotenberg.

How do I fix CVE-2026-42591?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-42591 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42591 exists.

Other vulnerabilities in gotenberg

• CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values Critical 10.0
• CVE-2026-42589 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection Critical 9.8
• CVE-2020-13450 Path traversal in n/a Critical 9.8
• CVE-2020-13451 Code injection in n/a Critical 9.8
• CVE-2020-13452 Privilege escalation in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rm4c-xj6x-49mw, GO-2026-5627.