CyberRota Analysis
AI-GeneratedThe Gotenberg API, prior to version 8.34.0, is vulnerable to a blind Server-Side Request Forgery (SSRF) and limited local file disclosure through its /forms/libreoffice/convert endpoint, which can be exploited by specially crafted documents. This vulnerability allows attackers to manipulate document conversions to access external and local resources, posing significant risks to data confidentiality and system integrity. Organizations using affected versions of Gotenberg should prioritize upgrading to version 8.34.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in version 8.34.0.