CVE-2026-42591Disclosure(thecodingmachine / gotenberg)

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely bypassing the SSRF filters. This vulnerability is fixed in 8.32.0.

thecodingmachine CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gotenberg

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-05-10); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

thecodingmachine

Products

gotenberg

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Tayn🐛@Tayn511153d
Disclosure
Finally got my first CVE assigned 🎉 CVE-2026-42591 — High severity SSRF vulnerability (CVSS 8.2) in Gotenberg. Tenable: https://www.tenable.com/cve/CVE-2026-42591 Snyk: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV7PKGMODULESLIBREOFFICE-16438332 #bugbounty #infosec #CVE #SSRF https://t.co/0aQ7MIVKCe
Post summary
A new CVE (CVE-2026-42591) for an SSRF flaw in Gotenberg has been announced with a CVSS score of 8.2, but no PoC, exploit, or patch information is provided.
0001099
1.8K followersView on X
Kaitan ID Security@KaitanSecurity149d
Disclosure
⚠️ HIGH — CVE-2026-42591 Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms… CVSS 8.2 Full analysis → https://sec.kaitan.id/cves/CVE-2026-42591 #Docker #CyberSecurity #InfoSec
Post summary
The post announces a high‑severity vulnerability (CVSS 8.2) affecting Gotenberg’s LibreOffice conversion endpoint prior to version 8.32.0, with a brief technical description and a link to a full analysis.
0000046
90 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	thecodingmachine	gotenberg	-	-	-

Explore more

Back to dashboard thecodingmachine CVEs gotenberg vulnerabilities