CVE-2026-126799

Name of the Vulnerable Software and Affected Versions Gotenberg versions 8.31.0 through 8.37.0

Description An issue exists in the IsPublicIP() function that allows unauthenticated attackers to bypass private-IP deny-list protections by using IPv6 zone identifiers. By appending a zone, such as %25eth0, to the unspecified address or blocked IPv6 prefixes within downloadFrom, webhook, or Chromium/LibreOffice URLs, an attacker can perform a server-side request forgery (SSRF). This enables access to internal services and allows the attacker to read the responses within the generated PDF.

Recommendations Update Gotenberg to version 8.38.0 or later.