https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T09:33:10.546014+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-319010 EUVD-2026-319010 2026-10-06T09:33:10.577183+00:00 EUVD-2026-319010 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42596 fkie_cve-2026-42596 2026-10-06T09:33:10.577219+00:00

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127.0.0.1]:... and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets. This vulnerability is fixed in 8.31.0.

 https://cve.radiocsirt.org/vuln/ghsa-4vmc-gm8v-m35h GHSA-4vmc-gm8v-m35h — Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook 2026-10-06T09:33:10.577255+00:00

Affected: Go: github.com/gotenberg/gotenberg/v8

### Summary The default deny-lists used by Gotenberg's `downloadFrom` feature and `webhook` feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as `http://[::ffff:127.0.0.1]:...` and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets.

### Details The issue originates from the shipped default deny-list regexes and the way those regexes are applied:

- `pkg/modules/api/api.go:198-200` defines the default `api-download-from-deny-list`. - `pkg/modules/webhook/webhook.go:41-43` defines the default `webhook-deny-list`. - `pkg/gotenberg/filter.go:20-69` evaluates those patterns with `regexp2` using case-sensitive matching.

The attacker-controlled URL then reaches outbound request sinks:

- `pkg/modules/api/context.go:208-282` - Reads attacker-supplied `downloadFrom`. - Calls `gotenberg.FilterDeadline(...)`. - Issues an outbound GET with `retryablehttp.NewRequest(...)` and `client.Do(...)`. - `pkg/modules/webhook/middleware.go:99-217` - Reads `Gotenberg-Webhook-Url` and `Gotenberg-Webhook-Events-Url`. - Calls `gotenberg.FilterDeadline(...)`. - Constructs a `client` for outbound delivery. - `pkg/modules/webhook/client.go:39-152` - Sends the success or error webhook request. - `pkg/modules/webhook/client.go:155-216` - Sen…