Gotenberg, an API‑driven document conversion service, suffered from an unauthenticated blind SSRF vulnerability that allows an attacker to force the server to send arbitrary HTTP POST requests to any URL supplied in the Gotenberg‑Webhook‑Url header. The filtering logic intended to block outbound URLs fails when the allow‑list and deny‑list are empty, the default configuration, allowing any target. Because the response body is never returned and only a status is checked, the attack remains discrete but can be used to probe internal services, confirm reachability of cloud metadata endpoints, and trigger side‑effects on internal hosts.

The vulnerability exists in Gotenberg version 8.29.1 and earlier when the GOTENBERG_API_WEBHOOK_ALLOW_LIST and GOTENBERG_API_WEBHOOK_DENY_LIST environment variables are left empty, which is the default configuration. The issue was fixed in version 8.31.0, which correctly enforces the filtering logic. All instances running 8.29.1 or older without an explicit allow‑list or deny‑list configured are at risk.

The attack vector is network‑based and requires only unauthenticated HTTP access to a Gotenberg instance. The CVSS score of 6.9 indicates medium severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, which suggests that while the vulnerability is known, widespread exploitation may still be limited. Nevertheless, because the blind SSRF can be used for internal reconnaissance or to manipulate services that perform side‑effects, this attack can assist in a broader compromise or disrupt internal operations.