Vulnerabilities in gotenberg
16 resultsVexday analysis
Gotenberg apresenta 16 vulnerabilidades conhecidas, com 14 divulgadas nos últimos 90 dias, indicando exposição recente significativa. Nenhuma vulnerabilidade está sob exploração ativa confirmada (KEV), mas 3 são críticas, e a fraqueza dominante é CWE-918 (requisições HTTP não autorizadas), padrão comum em ferramentas de processamento de documentos. A concentração de publicações recentes sugere ciclo de descoberta e correção acelerado, recomendando monitoramento próximo de patches.
CVE-2026-42589CRITICALGotenberg: Unauthenticated RCE via ExifTool Metadata Key InjectionEPSS 3.0%CVE-2026-40281CRITICALGotenberg vulnerable to argument injection via newlines in ExifTool metadata valuesEPSS 0.6%CVE-2026-27018HIGHGotenberg: Chromium deny-list bypass via case-insensitive URL schemeEPSS 0.5%CVE-2026-35458HIGHGotenberg has a ReDoS via extraHttpHeaders scope featureEPSS 0.5%CVE-2026-40280HIGHGotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-listsEPSS 0.5%CVE-2026-55229HIGHGotenberg: SSRF via LibreOffice document processingEPSS 0.4%CVE-2026-42596CRITICALGotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookEPSS 0.4%CVE-2026-42594HIGHGotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutineEPSS 0.3%CVE-2026-40893HIGHGotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and MoveEPSS 0.3%CVE-2026-42595HIGHGotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List BypassEPSS 0.3%CVE-2026-42593MEDIUMGotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routesEPSS 0.3%CVE-2026-42590HIGHGotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklistEPSS 0.3%CVE-2026-42591HIGHGotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8EPSS 0.3%CVE-2026-42597MEDIUMGotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// schemeEPSS 0.3%CVE-2026-39383MEDIUMGotenberg unauthenticated blind SSRF via unfiltered webhook URLEPSS 0.2%CVE-2026-42592MEDIUMGotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routesEPSS 0.2%