Gotenberg is a Docker‑powered stateless API for PDF files. Prior to version 8.34.0, its /forms/libreoffice/convert endpoint accepts a specially crafted document that causes LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during conversion. This leads to blind Server‑Side Request Forgery against internal resources and limited local file disclosure via linked image resource loading. The vulnerability arises from an uncontrolled network request performed by the application and is classified as CWE‑918. The issue is resolved in Gotenberg 8.34.0.

All Gotenberg releases before version 8.34.0 are impacted. The issue manifests in the /forms/libreoffice/convert API endpoint on Docker‑based Gotenberg in the LibreOffice conversion component bundled with Gotenberg.

The CVSS score of 7.5 indicates a high‑severity flaw. The EPSS score of < 1% indicates that exploitation is unlikely but still possible, and the absence of a KEV listing suggests the vulnerability is not yet widely exploited. The most likely attack vector is an attacker supplying a malicious document to the /forms/libreoffice/convert endpoint, which the server processes blindly, initiating outbound requests to arbitrary destinations. If the endpoint is publicly accessible or lacks proper authentication, the risk escalates to remote exploitation of internal resources.