The vulnerability allows an attacker to read arbitrary files located under /tmp by supplying a file:// URL to the Chromium conversion and screenshot routes. The affected routes do not enforce the per-request AllowedFilePrefixes guard, which is normally used to restrict file access to per‑request working directories. Consequently, an attacker can enumerate files in /tmp, locate Gotenberg’s temporary directories for other conversion jobs, and read the raw source files that will be rendered into PDFs. The result is an information disclosure that could expose sensitive data associated with other users’ conversions. This weakness is classified under CWE‑73 (Absolute Path Traversal) and CWE‑918 (Server‑Side Request Forgery).

Gotenberg versions prior to 8.32.0, including all 8.31.x releases and earlier. The product is a Docker‑powered stateless API used for PDF generation and rendering.

The CVSS score is 5.9, indicating a medium severity risk. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploitation at this time. The attack can be performed by anyone who can access the anonymous URL routes, meaning no authentication is required. The attacker only needs to craft a URL pointing to a file:// path within /tmp and submit it against the exposed endpoints. The absence of authentication or input validation makes the exploit straightforward once the routes are reachable.