https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-42597.htmlhttps://patchthecve.com/cve/CVE-2026-42597.htmlWed, 17 Jun 2026 10:48:08 +0000MEDIUM 5.9: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/convert/url and /forms/chromium/screenshot/url routes accept url=file:///tmp/... from anonymous callers. The default Chromium deny-list intentionally exempts file:///tmp/ so HTML/Markdown routes can load https://patchthecve.com/cve/CVE-2026-42596.htmlhttps://patchthecve.com/cve/CVE-2026-42596.htmlWed, 17 Jun 2026 10:48:08 +0000CRITICAL 9.4: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127https://patchthecve.com/cve/CVE-2026-42595.htmlhttps://patchthecve.com/cve/CVE-2026-42595.htmlWed, 17 Jun 2026 10:48:07 +0000HIGH 8.6: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/forms/chromium/convert/url) has no default protection against HTTP/HTTPS-based SSRF. The default deny-list regex only blocks file:// URIs. An unauthenticated attacker can point Chrohttps://patchthecve.com/cve/CVE-2026-42594.htmlhttps://patchthecve.com/cve/CVE-2026-42594.htmlWed, 17 Jun 2026 10:48:07 +0000HIGH 7.5: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handler returns ErrAsyncProcess and Echo recycles the context back to its sync.Pool. When a concurrent requhttps://patchthecve.com/cve/CVE-2026-42593.htmlhttps://patchthecve.com/cve/CVE-2026-42593.htmlWed, 17 Jun 2026 10:48:07 +0000MEDIUM 5.3: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfengines/split, libreoffice/convert, chromium/convert/url, chromium/convert/html, and chromium/convert/markdown accept stampSource=pdf + stampExpression=/path and watermarkSource=pdf + watermarkExpressionhttps://patchthecve.com/cve/CVE-2026-42592.htmlhttps://patchthecve.com/cve/CVE-2026-42592.htmlWed, 17 Jun 2026 10:48:07 +0000MEDIUM 5.3: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolves the hostname, checks the resolved IPs against the private-address deny-list, and returns only the error. It discards the resolved addresses. Chromium later performs its own DNS resolution when it nhttps://patchthecve.com/cve/CVE-2026-42591.htmlhttps://patchthecve.com/cve/CVE-2026-42591.htmlWed, 17 Jun 2026 10:48:06 +0000HIGH 8.2: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely https://patchthecve.com/cve/CVE-2026-42590.htmlhttps://patchthecve.com/cve/CVE-2026-42590.htmlWed, 17 Jun 2026 10:48:06 +0000HIGH 8.2: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Gotenberg can be bypassed using ExifTool's group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. ExifTool supports group-prefix synthttps://patchthecve.com/cve/CVE-2026-42589.htmlhttps://patchthecve.com/cve/CVE-2026-42589.htmlWed, 17 Jun 2026 10:48:06 +0000CRITICAL 9.8: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded in ahttps://patchthecve.com/cve/CVE-2026-40893.htmlhttps://patchthecve.com/cve/CVE-2026-40893.htmlWed, 17 Jun 2026 10:45:50 +0000HIGH 8.2: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. Thhttps://patchthecve.com/cve/CVE-2026-40281.htmlhttps://patchthecve.com/cve/CVE-2026-40281.htmlWed, 17 Jun 2026 10:44:56 +0000CRITICAL 10.0: Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate argumhttps://patchthecve.com/cve/CVE-2026-39383.htmlhttps://patchthecve.com/cve/CVE-2026-39383.htmlFri, 24 Jul 2026 21:10:00 +0000HIGH 7.2: Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url request header. The Fhttps://patchthecve.com/cve/CVE-2026-40280.htmlhttps://patchthecve.com/cve/CVE-2026-40280.htmlFri, 24 Jul 2026 21:10:00 +0000HIGH 7.5: Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes