CVE-2026-40280 Details
Description
Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data/. This bypasses the same security control that was patched in CVE-2026-27018. This issue has been fixed in version 8.31.0.
A vulnerability in Gotenberg versions through 8.30.1 allows for a bypass of the default private-IP deny-lists used in the webhook and api-download-from features. The deny-lists employ a case-sensitive regular expression to match URL schemes, which can be circumvented by using uppercase or mixed-case variants. This exploitation enables unauthenticated requests to access internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints. The vulnerability arises because Go's net/url.Parse() normalizes the scheme to lowercase before establishing outbound TCP connections, thereby bypassing the intended restrictions. This issue has been fixed in Gotenberg version 8.31.0.
Users can update to Gotenberg version 8.31.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5q7p-7jgv-ww56 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/advisories/GHSA-jjwv-57xh-xr6r | [email protected] | Not Applicable |
| https://github.com/gotenberg/gotenberg/commit/3f01ca18d3cc21375a1e2da4b5a3f261c8548e47 | [email protected] | Patch |
| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5q7p-7jgv-ww56 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| thecodingmachine gotenberg | < 8.31.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | New CVE Received | [email protected] |