PT-2026-38387 · Gotenberg · Gotenberg

Adrgs · Published 2026-05-07 · Updated 2026-06-25 · CVE-2026-42597

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.32.0

Description Anonymous callers can access the '/forms/chromium/convert/url' and '/forms/chromium/screenshot/url' endpoints using the url parameter with the file:///tmp/ scheme. While a deny-list exists to prevent arbitrary file access, it intentionally exempts the /tmp/ directory to allow certain routes to load local assets. However, the URL routes fail to implement the AllowedFilePrefixes guard, which is intended to scope these reads. This allows an attacker to enumerate the /tmp/ directory and read raw source files of other concurrent conversion requests, such as uploaded HTML, Markdown, or Office documents, which are then returned as rendered PDF output. This can lead to cross-tenant document exfiltration in multi-tenant deployments.

Recommendations Update to version 8.32.0. As a temporary workaround, restrict access to the '/forms/chromium/convert/url' and '/forms/chromium/screenshot/url' endpoints to trusted users only.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-73

CWE-918

Related Identifiers

CVE-2026-42597

GHSA-G924-CJX7-2RJW

GO-2026-5395

Affected Products

Gotenberg

References · 6

• 🔥 https://github.com/gotenberg/gotenberg/security/advisories/GHSA-g924-cjx7-2rjw · Exploit
• https://osv.dev/vulnerability/GO-2026-5395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42597 · Security Note
• https://osv.dev/vulnerability/GHSA-g924-cjx7-2rjw · Vendor Advisory
• https://github.com/gotenberg/gotenberg · Note
• https://t.me/CVEtracker/53797 · Telegram Post