—Go
GO-2026-5605· CVE-2026-42594, GHSA-r33j-c622-r6qpGotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine in github.com/gotenberg/gotenberg
Modified: 6/25/2026
package
Go/github.com/gotenberg/gotenberg/v8
pkg:go/github.com/gotenberg/gotenberg/v8
—Go
GO-2026-5627· CVE-2026-42591, GHSA-rm4c-xj6x-49mwGotenberg has a Server-Side Request Forgery (SSRF) Issue in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5636· CVE-2026-42589, GHSA-rqgh-gxv4-6657Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5669· CVE-2026-45742, GHSA-vp73-vjw8-8f32Gotenberg has a Race Condition via Multipart `downloadFrom` Handling in github.com/gotenberg/gotenberg
Modified: 6/25/2026
HIGH7.5Go
GHSA-2mrg-35hw-x3x9· CVE-2026-55229, GO-2026-5060Gotenberg: SSRF via LibreOffice document processing
Modified: 6/25/2026
MEDIUM5.3Go
GHSA-2pmr-289p-44r3· CVE-2026-42592, GO-2026-4990Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-3cv5-q585-h563· CVE-2026-42593, GO-2026-5080Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes
Modified: 6/25/2026
CRITICAL9.4Go
GHSA-4vmc-gm8v-m35h· CVE-2026-42596, GO-2026-5132Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
Modified: 6/25/2026
CRITICAL9.3Go
GHSA-5q7p-7jgv-ww56· CVE-2026-40280, GO-2026-5151Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
Modified: 7/8/2026
HIGH8.6Go
GHSA-5vh4-rgv7-p9g4· CVE-2026-39383, GO-2026-5155Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL
Modified: 6/25/2026
HIGH8.2Go
GHSA-62p3-hvxx-fxg4· CVE-2026-40893, GO-2026-5162Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move
Modified: 6/25/2026
HIGH8.2Go
GHSA-7v3r-m9c8-r855· CVE-2026-42590, GO-2026-5234Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist
Modified: 7/21/2026
HIGH7.5Go
GHSA-86m8-88fq-xfxp· CVE-2026-45741, GO-2026-5244Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes
Modified: 9/10/2026
HIGH8.6Go
GHSA-chwh-f6gm-r836· CVE-2026-42595, GO-2026-5324Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
Modified: 7/21/2026
HIGHGo
GHSA-fmwg-qcqh-m992· CVE-2026-35458, GO-2026-5372Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature
Modified: 6/25/2026
MEDIUM5.9Go
GHSA-g924-cjx7-2rjw· CVE-2026-42597, GO-2026-5395Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme
Modified: 7/21/2026
HIGH8.8Go
GHSA-hwc4-gmrw-5222· CVE-2026-44829, GO-2026-5443Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename
Modified: 6/25/2026
HIGHGo
GHSA-jjwv-57xh-xr6r· CVE-2026-27018, GO-2026-4905Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)
Modified: 7/8/2026
CRITICAL10.0Go
GHSA-q7r4-hc83-hf2q· CVE-2026-40281, GO-2026-5572Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)
Modified: 6/25/2026
HIGHGo
GHSA-qmwh-9m9c-h36m· GO-2026-5587Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags
Modified: 6/25/2026
HIGH7.5Go
GHSA-r33j-c622-r6qp· CVE-2026-42594, GO-2026-5605Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine
Modified: 6/25/2026
HIGH8.2Go
GHSA-rm4c-xj6x-49mw· CVE-2026-42591, GO-2026-5627Gotenberg has a Server-Side Request Forgery (SSRF) Issue
Modified: 6/25/2026
CRITICAL9.8Go
GHSA-rqgh-gxv4-6657· CVE-2026-42589, GO-2026-5636Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection
Modified: 6/25/2026
HIGH7.5Go
GHSA-vp73-vjw8-8f32· CVE-2026-45742, GO-2026-5669Gotenberg has a Race Condition via Multipart `downloadFrom` Handling
Modified: 6/25/2026
—Go
GO-2024-2996· CVE-2024-21527CVE-2024-21527 in github.com/gotenberg/gotenberg
Modified: 3/3/2026
—Go
GO-2026-4905· CVE-2026-27018, GHSA-jjwv-57xh-xr6rGotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3) in github.com/gotenberg/gotenberg
Modified: 4/2/2026
—Go
GO-2026-4990· CVE-2026-42592, GHSA-2pmr-289p-44r3Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes in github.com/gotenberg/gotenberg
Modified: 8/7/2026
—Go
GO-2026-5060· CVE-2026-55229, GHSA-2mrg-35hw-x3x9Gotenberg: SSRF via LibreOffice document processing in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5080· CVE-2026-42593, GHSA-3cv5-q585-h563Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5132· CVE-2026-42596, GHSA-4vmc-gm8v-m35hGotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5151· CVE-2026-40280, GHSA-5q7p-7jgv-ww56Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5155· CVE-2026-39383, GHSA-5vh4-rgv7-p9g4Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5162· CVE-2026-40893, GHSA-62p3-hvxx-fxg4Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5234· CVE-2026-42590, GHSA-7v3r-m9c8-r855Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5244· CVE-2026-45741, GHSA-86m8-88fq-xfxpGotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes in github.com/gotenberg/gotenberg
Modified: 7/2/2026
—Go
GO-2026-5324· CVE-2026-42595, GHSA-chwh-f6gm-r836Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5372· CVE-2026-35458, GHSA-fmwg-qcqh-m992Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5395· CVE-2026-42597, GHSA-g924-cjx7-2rjwGotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5443· CVE-2026-44829, GHSA-hwc4-gmrw-5222Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5572· CVE-2026-40281, GHSA-q7r4-hc83-hf2qGotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix) in github.com/gotenberg/gotenberg
Modified: 6/25/2026
—Go
GO-2026-5587· GHSA-qmwh-9m9c-h36mGotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags in github.com/gotenberg/gotenberg
Modified: 6/25/2026