Product by Thecodingmachine
Gotenberg
22 known vulnerabilities in Gotenberg (Thecodingmachine), 0 of them actively exploited (CISA KEV).
Key figures
22
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-42589 | Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection | 9.8 | |
| Critical | CVE-2026-40281 | Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values | 10.0 | |
| Critical | CVE-2020-13450 | Thecodingmachine Gotenberg: Path Traversal | 9.8 | |
| Critical | CVE-2020-13451 | Thecodingmachine Gotenberg: Code Execution | 9.8 | |
| Critical | CVE-2026-42596 | Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook | 9.4 | |
| Critical | CVE-2020-13452 | Thecodingmachine Gotenberg: Denial of Service | 9.8 | |
| High | CVE-2026-40280 | Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists | 7.5 | |
| High | CVE-2020-13449 | Thecodingmachine Gotenberg: Path Traversal | 7.5 | |
| High | CVE-2026-27018 | Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme | 7.5 | |
| High | CVE-2020-14160 | Thecodingmachine Gotenberg: Server-Side Request Forgery (SSRF) | 7.5 | |
| Critical | CVE-2026-35458 | Gotenberg has a ReDoS via extraHttpHeaders scope feature | 9.8 | |
| High | CVE-2026-42595 | Gotenberg: Server-Side Request Forgery (SSRF) | 8.6 | |
| High | CVE-2026-40893 | Gotenberg: External Control of File Name or Path | 8.2 | |
| High | CVE-2026-42590 | Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist | 8.2 | |
| High | CVE-2026-42594 | Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine | 7.5 | |
| High | CVE-2026-42591 | Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8 | 8.2 | |
| Medium | CVE-2021-23345 | Server-side Request Forgery (SSRF) | 5.3 | |
| Medium | CVE-2020-14161 | Thecodingmachine Gotenberg: security vulnerability | 6.1 | |
| High | CVE-2026-39383 | Gotenberg unauthenticated blind SSRF via unfiltered webhook URL | 7.2 | |
| Medium | CVE-2026-42597 | Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme | 5.9 | |
| Medium | CVE-2026-42593 | Gotenberg: Path Traversal | 5.3 | |
| Medium | CVE-2026-42592 | Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes | 5.3 |