Ggotenberg

Products

Exploited and recent CVEs

• CVE-2026-44829 High 8.8 Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename 0.5%
• CVE-2026-45742 High 7.5 Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') 0.7%
• CVE-2026-45741 High 7.5 Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes 0.4%
• CVE-2026-55229 High 7.5 Gotenberg: SSRF via LibreOffice document processing 1.5%
• CVE-2026-42590 High 8.2 Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist 0.3%
• CVE-2026-42597 Medium 5.9 Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme 0.3%
• CVE-2026-42595 High 8.6 Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass 0.3%
• CVE-2026-42594 High 7.5 Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine 0.3%
• CVE-2026-42593 Medium 5.3 Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes 0.3%
• CVE-2026-42592 Medium 5.3 Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes 0.2%
• CVE-2026-42591 High 8.2 Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8 0.3%
• CVE-2026-42596 Critical 9.4 Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook 1.6%
• CVE-2026-40893 High 8.2 Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move 0.3%
• CVE-2026-42589 Critical 9.8 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection 3.0%
• CVE-2026-40281 Critical 10.0 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values 2.3%
• CVE-2026-39383 Medium 6.9 Gotenberg unauthenticated blind SSRF via unfiltered webhook URL 0.2%
• CVE-2026-40280 High 7.8 Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists 1.9%
• CVE-2026-35458 Critical 9.8 Gotenberg has a ReDoS via extraHttpHeaders scope feature 0.5%
• CVE-2026-27018 High 7.8 Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme 1.7%