PT-2026-37104 · Gotenberg · Gotenberg

Morimori-Dev · Published 2026-04-30 · Updated 2026-05-07 · CVE-2026-40280

Positive Technologies (AI Summary)

CVSS v4.0

7.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Gotenberg versions 8.30.1 and earlier

Description Gotenberg is an API-based document conversion tool. The default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression to match URL schemes. Because the net/url.Parse() function normalizes the scheme to lowercase before establishing an outbound TCP connection, an attacker can bypass the deny-list by capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints. The issue involves the FilterDeadline() function and specific logic within pkg/modules/webhook/webhook.go and pkg/modules/api/api.go.

Recommendations Update Gotenberg to version 8.31.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-40280

GHSA-5Q7P-7JGV-WW56

Affected Products

Gotenberg

References · 11

• 🔥 https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5q7p-7jgv-ww56 · Exploit
• https://github.com/gotenberg/gotenberg/commit/3f01ca18d3cc21375a1e2da4b5a3f261c8548e47 · Patch
• https://osv.dev/vulnerability/GHSA-5q7p-7jgv-ww56 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40280 · Security Note
• https://github.com/gotenberg/gotenberg · Note
• https://github.com/gotenberg/gotenberg/releases/tag/v8.31.0 · Note
• https://t.me/cveNotify/162554 · Telegram Post
• https://twitter.com/CVEnew/status/2051758498212405733 · Twitter Post
• https://t.me/CVEtracker/52786 · Telegram Post
• https://github.com/advisories/GHSA-jjwv-57xh-xr6r · Note
• https://twitter.com/VulmonFeeds/status/2051780039318880421 · Twitter Post