The vulnerability arises from a case-sensitive regular expression used to filter disallowed URL schemes in Gotenberg’s webhook and API download functions. Because Go’s URL parser normalizes the scheme to lowercase before establishing a TCP connection, an attacker can bypass the deny‑list by capitalizing the scheme (e.g., HTTP://). This SSRF flaw allows an unauthenticated attacker to cause Gotenberg to make outbound requests to internal IP ranges, loopback addresses, and cloud metadata endpoints, potentially exposing sensitive data or facilitating further internal attacks. The weakness is classified as CWE-918. The likely attack vector is an unauthenticated HTTP request to the webhook or download endpoint.

Gotenberg, version 8.30.1 and earlier, which includes the vulnerable deny‑lists logic. The product is an API‑based document conversion tool used in various CI/CD pipelines.

With a CVSS score of 7.8, this issue qualifies as a high‑severity vulnerability. Although no EPSS score is available, the lack of authentication and the straightforward bypass technique make exploitation likely in environments where Gotenberg is exposed to untrusted clients. The flaw is not listed in CISA KEV, but its potential to expose internal services makes it a significant risk. An attacker can exploit it by sending a crafted request containing a capitalized scheme to the webhook or API download endpoint; the server will then resolve the internal IP address and establish a connection, leaking data or enabling further lateral movement.