CVE-2026-42596
Description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127.0.0.1]:... and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets. This vulnerability is fixed in 8.31.0.
How to fix
- thecodingmachine gotenberg8.31.0 or later
- github.com/gotenberg/gotenberg/v88.32.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thecodingmachine gotenberg | v < 8.31.0 | 8.31.0 |
| github.com/gotenberg/gotenberg/v8Go | v < 8.32.0 | 8.32.0 |
| github.com/gotenberg/gotenberg/v7Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.