CVE-2026-42595Disclosure(thecodingmachine / gotenberg)

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/forms/chromium/convert/url) has no default protection against HTTP/HTTPS-based SSRF. The default deny-list regex only blocks file:// URIs. An unauthenticated attacker can point Chromium at any internal IP — including loopback, RFC 1918 ranges, and cloud metadata endpoints — and receive the response rendered as a PDF. Additionally, even when operators configure a custom deny-list, the protection is bypassed via HTTP redirects. Gotenberg's Chromium instance follows 302 redirects from an attacker-controlled external URL to internal targets without re-validating the redirect destination against the deny-list. This vulnerability is fixed in 8.32.0.

thecodingmachine CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gotenberg

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

thecodingmachine

Products

gotenberg

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://sec.kaitan.id/cves/CVE-2026-42595

Full discourse1 post

Kaitan ID Security@KaitanSecurity147d
Disclosure
⚠️ HIGH — CVE-2026-42595 Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/… CVSS 8.6 Full analysis → https://sec.kaitan.id/cves/CVE-2026-42595 #Docker #CyberSecurity #InfoSec
Post summary
The text announces a new CVE-2026-42595 affecting Gotenberg, assigning it a CVSS score of 8.6, and links to a detailed analysis without offering PoC, exploit, or patch information.
0000042
90 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	thecodingmachine	gotenberg	-	-	-

Explore more

Back to dashboard thecodingmachine CVEs gotenberg vulnerabilities