LibreOffice

LibreOffice is affected by multiple vulnerabilities that could allow a local attacker to execute arbitrary code, manipulate data, or disclose sensitive information.

A vulnerability in LibreOffice allows a remote, unauthenticated attacker to execute arbitrary code on the victim's system via maliciously crafted files.

Gotenberg is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient hardening in the LibreOffice conversion endpoint, allowing attackers to make outbound HTTP requests by embedding external URLs in uploaded documents, bypassing Gotenberg's SSRF filters, affecting versions up to 8.31.0, and potentially enabling access to internal services, data exfiltration, or port scanning.