{“lastseen”:””,”description”:”Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the –webhook-deny-list and –api-download-from-deny-list flags use a case-sensitive regular expression (^https?:\/\/) to match URL schemes. Because Go’s net\/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP:\/\/, HTTPS:\/\/, or Http:\/\/). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP:\/\/169.254.169.254\/latest\/meta-data\/. \\n\\nThis bypasses the same security control that was patched in CVE-2026-27018.\\n\\nThis issue has been fixed in version 8.31.0.”,”published”:”2026-05-05T19:52:40.327Z”,”modified”:”2026-05-05T19:52:40.327Z”,”type”:”cve”,”title”:”Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists”,”source”:”GitHub_M”,”references”:”https:\/\/github.com\/gotenberg\/gotenberg\/security\/advisories\/GHSA-5q7p-7jgv-ww56\\nhttps:\/\/github.com\/gotenberg\/gotenberg\/commit\/3f01ca18d3cc21375a1e2da4b5a3f261c8548e47\\nhttps:\/\/github.com\/advisories\/GHSA-jjwv-57xh-xr6r”,”id”:”CVE-2026-40280″,”bulletinFamily”:””,”cwe”:[“CWE-918″],”cvelist”:null,”sourceData”:”gotenberg gotenberg \\u003c= 8.30.1″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:N\/VI:N\/VA:N\/SC:H\/SI:L\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”gotenberg”,”version”:”\\u003c= 8.30.1″,”vendor”:”gotenberg”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the –webhook-deny-list and –api-download-from-deny-list flags use a case-sensitive…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-51595","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n