Gotenberg is a Docker‑powered stateless API that converts documents to PDF using LibreOffice. Prior to version 8.32.0, the LibreOffice conversion endpoint accepts user‑supplied documents and forwards them directly to LibreOffice without validating their contents. LibreOffice then follows any embedded external URLs contained in the document, which bypasses the built‑in SSRF filters. The result is that an attacker can cause the Gotenberg server to initiate requests to arbitrary internal or external destinations by crafting a malicious document, potentially revealing sensitive information or facilitating further attacks.

The affected product is Gotenberg from the vendor gotenberg. All installations running any version earlier than 8.32.0 are vulnerable. The vulnerability was introduced in the libreoffice conversion endpoint of the API.

The CVSS score of 8.2 classifies this as a high‑severity flaw. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is the upload of a crafted document to the LibreOffice conversion endpoint, which causes the LibreOffice process to request embedded URLs, potentially accessing internal hosts or bypassing network controls.