CVE-2026-42596: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature…

PriorityP260critical9.4CVSS 3.1

AVNACLPRNUINSUCHIHAL

EPSS

0.35%

27.0th percentile

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127.0.0.1]:... and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets. This vulnerability is fixed in 8.31.0.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
github.com	gotenberg_gotenberg_v8	>= 0 < 8.32.0	8.32.0
gotenberg	gotenberg	< 8.31.0	8.31.0
thecodingmachine	gotenberg	< 8.31.0	8.31.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.