Gotenberg (8.31.0 - 8.37.x) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gotenberg-8.31.0---8.37.x/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:08:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGotenberg: Server-side request forgery vulnerability (CVE-2026-126799)https://feed.craftedsignal.io/briefs/2026-11-gotenberg-ssrf-cve-2026-126799/Wed, 11 Nov 2026 22:08:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-gotenberg-ssrf-cve-2026-126799/Gotenberg versions 8.31.0 through 8.37.x contain a server-side request forgery vulnerability in the IsPublicIP function, allowing unauthenticated attackers to bypass private IP restrictions via IPv6 zone identifiers to access internal network services.Gotenberg versions 8.31.0 through 8.37.x are vulnerable to a server-side request forgery (SSRF) vulnerability due to improper validation within the IsPublicIP function. This flaw allows unauthenticated attackers to bypass private-IP deny-list protections by appending IPv6 zone identifiers (e.g., %25eth0) to URLs processed by the application, such as in downloadFrom, webhook, or Chromium/LibreOffice configurations.

Impact

Successful exploitation allows an attacker to bypass security restrictions and interact with internal network services that would otherwise be blocked. This enables the attacker to read responses from internal resources, which are subsequently returned within the generated PDF document.

Recommendation

Upgrade Gotenberg to version 8.38.0 or later immediately to patch CVE-2026-126799. As a temporary mitigation, restrict the ability of Gotenberg instances to reach internal network addresses or sensitive internal services through network-level firewall controls.

]]>highadvisory