PT-2026-28098 · Gotenberg · Gotenberg

Q1Uf3Ng · Published 2026-03-25 · Updated 2026-05-07 · CVE-2026-27018

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.29.0

Description Gotenberg, an API for converting document formats, contains a flaw related to URL scheme handling. A previously implemented fix for CVE-2024-21527 could be bypassed by utilizing mixed-case or uppercase URL schemes, such as FILE:///etc/passwd or File:///etc/passwd. The issue stems from a case-sensitive regular expression used in the FilterDeadline function within pkg/gotenberg/filter.go, which does not account for the case-insensitivity of URI schemes as defined in RFC 3986 Section 3.1. This allows attackers to bypass the intended security measures and potentially read arbitrary files from the Gotenberg container. The vulnerability affects both the URL endpoint and HTML conversion processes, including those involving iframes and link tags. The vulnerable code resides in pkg/modules/chromium/chromium.go, pkg/gotenberg/filter.go, and pkg/modules/chromium/events.go. The API endpoint ''/forms/chromium/convert/url'' is affected, utilizing the url parameter.

Recommendations Gotenberg versions prior to 8.29.0 should be updated to version 8.29.0 or later.

Exploit

Fix

Path traversal

SSRF

Weakness Enumeration

CWE-22

CWE-918

Related Identifiers

CVE-2026-27018

GHSA-JJWV-57XH-XR6R

GO-2026-4905

SUSE-SU-2026:1205-1

Affected Products

Gotenberg

References · 51

• 🔥 https://github.com/gotenberg/gotenberg/security/advisories/GHSA-jjwv-57xh-xr6r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27018.json · Exploit
• https://github.com/gotenberg/gotenberg/commit/06b2b2e10c52b58135edbfe82e94d599eb0c5a11 · Patch
• https://github.com/gotenberg/gotenberg/commit/8625a4e899eb75e6fcf46d28394334c7fd79fff5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27018 · Security Note
• https://osv.dev/vulnerability/GHSA-jjwv-57xh-xr6r · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1205-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4905 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27018 · Vendor Advisory
• https://github.com/gotenberg/gotenberg · Note
• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rh2x-ccvw-q7r3 · Note
• https://github.com/gotenberg/gotenberg/releases/tag/v8.29.0 · Note
• https://suse.com/security/cve/CVE-2026-27018 · Note
• https://t.me/cveNotify/162554 · Telegram Post
• https://suse.com/security/cve/CVE-2026-33027 · Note