SB20261109155 - Multiple vulnerabilities in gotenberg

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109155

SB20261109155 - Multiple vulnerabilities in gotenberg

Published: November 9, 2026

Security Bulletin ID SB20261109155
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Race condition (CVE-ID: CVE-2026-45742)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to terminate the Gotenberg process and deny service to users.

The vulnerability exists due to unsynchronized writes to shared maps during multipart downloadFrom processing when a request contains multiple download entries. An unauthenticated remote attacker can submit a crafted request to an exposed multipart conversion endpoint with downloadFrom enabled and authentication disabled, as in the default configuration, to trigger a process crash.


2) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-45741)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read internal cloud metadata and obtain IAM credentials.

The vulnerability exists due to Gotenberg's IsPublicIP misclassifying IPv6 transition and site-local addresses as public when WithDenyPrivateIPs(true) is enabled on dual-stack or NAT64-enabled hosts. An unauthenticated remote attacker can supply a crafted DNS AAAA record and request Chromium URL conversion to receive internal responses as a PDF.


3) Path traversal (CVE-ID: CVE-2026-44829)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to write files outside a victim's extraction directory when the victim extracts a generated ZIP archive using a vulnerable Windows extractor.

The vulnerability exists due to Gotenberg's Linux filename sanitization preserving Windows path separators and parent-directory traversal sequences in uploaded filenames used as ZIP entry names. An unauthenticated remote attacker can submit crafted multipart filenames to a multi-output route to produce an archive containing traversal paths.


Remediation

Install update from vendor's website.

References