Technical impact
The vulnerability results from a case‑insensitive handling of URL schemes in Gotenberg’s Chromium component. An attacker can supply mixed‑case or all‑uppercase schemes that bypass the previously implemented deny‑list, enabling the service to retrieve and process arbitrary external URLs. This flaw allows the service to make unintended outbound network requests, potentially exposing internal resources or loading malicious content that could be used for further attacks. The weakness is identified as a path traversal (CWE‑22) and a server‑side request forgery (CWE‑918).
Affected Systems
All installations of Gotenberg from the Coding Machine prior to release 8.29.0 are vulnerable. The fix is included in version 8.29.0 and newer. Users running earlier versions should consider upgrade or temporary controls.
Risk and Exploitability
The CVSS score of 7.8 classifies the issue as High, and the EPSS score of 2 % indicates a low current exploitation rate. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending crafted URLs to a publicly accessible Gotenberg endpoint; no special privileges are required. While the flaw does not directly lead to code execution, the forced outbound request can be used to access internal services, perform data exfiltration, or facilitate additional attacks.
Github GHSA