Gotenberg up to 8.30.x URL FilterDeadline Gotenberg-Webhook-Url server-side request forgery

Summaryinfo

A vulnerability was found in Gotenberg up to 8.30.x. It has been classified as critical. Affected is the function FilterDeadline of the component URL Handler. This manipulation of the argument Gotenberg-Webhook-Url causes server-side request forgery. This vulnerability is handled as CVE-2026-39383. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in Gotenberg up to 8.30.x. Affected by this vulnerability is the function FilterDeadline of the component URL Handler. The manipulation of the argument Gotenberg-Webhook-Url with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url request header. The FilterDeadline function in filter.go is intended to gate outbound URLs, but when both the allow-list and deny-list are empty (the default configuration), it returns nil unconditionally and permits any URL. This is a blind SSRF: Gotenberg POSTs the converted document to the webhook URL and only checks whether the response status code is an error, but never returns the target's response body to the attacker. An attacker can use this to probe internal network infrastructure by observing whether the error callback is invoked, force POST requests against internal services that perform side effects, and confirm reachability of cloud metadata endpoints. The retryable HTTP client issues up to 4 automatic retries per request, amplifying each probe. This issue has been fixed in version 8.31.0. As a workaround, configure the GOTENBERG_API_WEBHOOK_ALLOW_LIST environment variable to restrict webhook URLs to known receivers, or set GOTENBERG_API_WEBHOOK_DENY_LIST to block RFC-1918 and link-local address ranges.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-39383 since 04/07/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Upgrading to version 8.31.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27494). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Gotenberg

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6
• 8.7
• 8.8
• 8.9
• 8.10
• 8.11
• 8.12
• 8.13
• 8.14
• 8.15
• 8.16
• 8.17
• 8.18
• 8.19
• 8.20
• 8.21
• 8.22
• 8.23
• 8.24
• 8.25
• 8.26
• 8.27
• 8.28
• 8.29
• 8.30

Website

• Product: https://github.com/gotenberg/gotenberg/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion