Gotenberg < 8.34.0 - Local File Disclosure
CVE-2026-55229
Verified
Description
Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document (such as a:blip r:link TargetMode="External") can instruct LibreOffice to fetch local resources (file://) or remote resources (http/https), which are then included as images in the generated PDF. This can disclose the contents of local files LibreOffice can open as images, or allow outbound requests to attacker-controlled endpoints. Version 8.34.0 disables resolution of external resources during document conversion to mitigate the vulnerability.
Severity
High
CVSS Score
7.5
Exploit Probability
2%
Affected Product
gotenberg
Published Date
August 8, 2026
Template Author
str4k3r
CVE-2026-55229.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-55229
CWE ID:
cwe-918
Remediation Steps
Update to version 8.34.0 or later.