CVE-2026-39383

Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url request header. The FilterDeadline function in filter.go is intended to gate outbound URLs, but when both the allow-list and deny-list are empty (the default configuration), it returns nil unconditionally and permits any URL. This is a blind SSRF: Gotenberg POSTs the converted document to the webhook URL and only checks whether the response status code is an error, but never returns the target's response body to the attacker. An attacker can use this to probe internal network infrastructure by observing whether the error callback is invoked, force POST requests against internal services that perform side effects, and confirm reachability of cloud metadata endpoints. The retryable HTTP client issues up to 4 automatic retries per request, amplifying each probe. This issue has been fixed in version 8.31.0. As a workaround, configure the GOTENBERG_API_WEBHOOK_ALLOW_LIST environment variable to restrict webhook URLs to known receivers, or set GOTENBERG_API_WEBHOOK_DENY_LIST to block RFC-1918 and link-local address ranges.

• CWE-918

• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5vh4-rgv7-p9g4Exploit, Mitigation, Vendor Advisory
• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5vh4-rgv7-p9g4Exploit, Mitigation, Vendor Advisory

Published

May 5, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39377The nbconvert tool, jupyter nbconvert, converts Jupyter note…6.5
• CVE-2026-39378The nbconvert tool, jupyter nbconvert, converts Jupyter note…6.5
• CVE-2026-3938Insufficient policy enforcement in Clipboard in Google Chrom…4.3
• CVE-2026-39380Open Source Point of Sale is a web based point-of-sale appli…5.4
• CVE-2026-39381Parse Server is an open source backend that can be deployed …4.3
• CVE-2026-39382dbt enables data analysts and engineers to transform their d…9.3
• CVE-2026-39384FreeScout is a free help desk and shared inbox built with PH…7.6
• CVE-2026-39385Frappe LMS is an open source learning management system. In …7.1
• CVE-2026-39386Neko is a a self-hosted virtual browser that runs in Docker …8.8
• CVE-2026-39387BoidCMS is an open-source, PHP-based flat-file CMS for build…7.2
• CVE-2026-39388OpenBao is an open source identity-based secrets management …3.1
• CVE-2026-39389CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …7.2