What’s Vulnerable › Products
gotenberg vulnerabilities
26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Check whether your gotenberg version is affected
Latest gotenberg vulnerabilities
- CVE-2026-45742 — Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVSS 7.5)
- CVE-2026-45741 — Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes (CVSS 7.5)
- CVE-2026-44829 — Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename (CVSS 8.8)
- CVE-2026-55229 — Gotenberg: SSRF via LibreOffice document processing (CVSS 7.5)
- CVE-2026-42597 — Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme (CVSS 5.9)
- CVE-2026-42596 — Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook (CVSS 9.4)
- CVE-2026-42595 — Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass (CVSS 8.6)
- CVE-2026-42594 — Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine (CVSS 7.5)
- CVE-2026-42593 — Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes (CVSS 5.3)
- CVE-2026-42592 — Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes (CVSS 5.3)
- CVE-2026-42591 — Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8 (CVSS 8.2)
- CVE-2026-42590 — Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist (CVSS 8.2)
- CVE-2026-42589 — Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection (CVSS 9.8)
- CVE-2026-40893 — Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move (CVSS 8.2)
- CVE-2026-40281 — Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values (CVSS 9.1)
- CVE-2026-39383 — Gotenberg unauthenticated blind SSRF via unfiltered webhook URL (CVSS 7.2)
- CVE-2026-40280 — Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists (CVSS 7.5)
- CVE-2026-35458 — Gotenberg has a ReDoS via extraHttpHeaders scope feature (CVSS 9.8)
- CVE-2026-27018 — Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme (CVSS 7.5)
- CVE-2020-14161 — (CVSS 6.1)
- CVE-2020-14160 — (CVSS 7.5)
- CVE-2021-23345 — Server-side Request Forgery (SSRF) (CVSS 5.3)
- CVE-2020-13452 — (CVSS 9.8)
- CVE-2020-13451 — (CVSS 9.8)
- CVE-2020-13450 — (CVSS 9.8)