The vulnerability is an unauthenticated Server‑Side Request Forgery that bypasses Gotenberg's default deny‑list when processing supplied download URLs and webhook payloads. Because the deny‑list uses a case‑sensitive regular expression, attackers can craft URLs containing IP‑in‑URL encodings such as http://[::ffff:127.0.0.1] that target loopback or other private addresses. The result is that Gotenberg can be commanded to fetch resources from internal‑only HTTP services, effectively exposing internal network endpoints to external callers. This satisfies CWE‑918.

The issue afflicts the Gotenberg project, an open‑source docker‑based API for PDF generation. All released versions before 8.31.0 are affected. Users who are running a prior build should identify the exact version of their Gotenberg container and consider upgrading.

The CVSS base score is 9.4, indicating critical severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the lack of an official listing does not reduce the inherent danger. Because authentication is not required and an attacker can supply arbitrary URLs over any network channel that can reach the Gotenberg endpoint, the exploitation attack vector is network‑based. The high score reflects the potential for broad internal exposure if the service is reachable from the internet.