Gotenberg is a Docker‑powered stateless API for PDF files. Prior to version 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in version 8.34.0.

All Gotenberg releases before version 8.34.0 are impacted. The issue manifests in the /forms/libreoffice/convert API endpoint on Docker‑based Gotenberg in the LibreOffice conversion component bundled with Gotenberg.

The CVSS score of 7.5 indicates a high‑severity flaw. The EPSS score of < 1% indicates that exploitation is unlikely but still possible, and the absence of a KEV listing suggests the vulnerability is not yet widely exploited. The most likely attack vector is an attacker supplying a malicious document to the /forms/libreoffice/convert endpoint, which the server processes blindly, initiating outbound requests to arbitrary destinations. If the endpoint is publicly accessible or lacks proper authentication, the risk escalates to remote exploitation of internal resources.