CVE-2026-42597 Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme
Attackers can read arbitrary files from /tmp via file:// scheme in URL conversion routes, exposing other users' data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42597?
CVE-2026-42597 is a medium-severity server-side request forgery vulnerability in gotenberg, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/convert/url and /forms/chromium/screenshot/url routes accept url=file:///tmp/... from anonymous callers. The default Chromium deny-list intentionally exempts file:///tmp/ so HTML/Markdown routes can load their own request-local assets, and those routes apply a per-request AllowedFilePrefixes guard to scope the read. The URL routes never set AllowedFilePrefixes, so the scope guard silently skips. Alice enumerates /tmp/, walks Gotenberg's per-request working directories, and reads the raw source files of other in-flight conversions as rendered PDF output. This vulnerability is fixed in 8.32.0.
Which versions are affected by CVE-2026-42597?
6 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v7 and github.com/gotenberg/gotenberg/v8. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gotenberg/gotenberg/v7 Go | All versions | None |
github.com/gotenberg/gotenberg/v7 Go | All versions to 7.10.2 | None |
github.com/gotenberg/gotenberg/v7 Go | All versions to 7.10.2 | None |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.32.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.32.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.32.0 |
Products include Thecodingmachine Gotenberg.
How do I fix CVE-2026-42597?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-42597 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42597 exists.
Other vulnerabilities in gotenberg
Sources
Also known as GHSA-g924-cjx7-2rjw, GO-2026-5395.