Vulnerability Description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127.0.0.1]:... and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets. This vulnerability is fixed in 8.31.0.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Thecodingmachine | Gotenberg | < 8.31.0 |
Related Weaknesses (CWE)
References
- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-4vmc-gm8v-m35hExploitMitigationVendor Advisory
- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-4vmc-gm8v-m35hExploitMitigationVendor Advisory
FAQ
What is CVE-2026-42596?
CVE-2026-42596 is a vulnerability with a CVSS score of 9.4 (CRITICAL). Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is re...
How severe is CVE-2026-42596?
CVE-2026-42596 has been rated CRITICAL with a CVSS base score of 9.4/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-42596?
Check the references section above for vendor advisories and patch information. Affected products include: Thecodingmachine Gotenberg.