Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M
CVE-2026-55229Gotenberg: SSRF via LibreOffice document processing
High 7.5
In plain English
A high-severity server-side request forgery in gotenberg from gotenberg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in version 8.34.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/gotenberg/gotenberg/v7 | no fix listed | GO-2026-5060 |
| Go | github.com/gotenberg/gotenberg/v8 | 8.34.0 | GHSA-2mrg-35hw-x3x9 |
| Go | github.com/gotenberg/gotenberg/v8 | 8.34.0 | GO-2026-5060 |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N