Vulnerability Description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/convert/url and /forms/chromium/screenshot/url routes accept url=file:///tmp/... from anonymous callers. The default Chromium deny-list intentionally exempts file:///tmp/ so HTML/Markdown routes can load their own request-local assets, and those routes apply a per-request AllowedFilePrefixes guard to scope the read. The URL routes never set AllowedFilePrefixes, so the scope guard silently skips. Alice enumerates /tmp/, walks Gotenberg's per-request working directories, and reads the raw source files of other in-flight conversions as rendered PDF output. This vulnerability is fixed in 8.32.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Thecodingmachine | Gotenberg | < 8.32.0 |
Related Weaknesses (CWE)
References
- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-g924-cjx7-2rjwExploitMitigationVendor Advisory
- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-g924-cjx7-2rjwExploitMitigationVendor Advisory
FAQ
What is CVE-2026-42597?
CVE-2026-42597 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/convert/url and /forms/chromium/screenshot/url routes accept url=file:///tmp/... from anonymous callers....
How severe is CVE-2026-42597?
CVE-2026-42597 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42597?
Check the references section above for vendor advisories and patch information. Affected products include: Thecodingmachine Gotenberg.