Home / Vulnerability Intelligence / CVE-2026-42591

CVE-2026-42591 - Vulnerability Analysis

HighCVSS: 8.2

Last Updated: May 14, 2026

Gotenberg - Server Side Request Forgery

Published: May 14, 2026Updated: May 14, 2026Remote Exploitable

Overview

Gotenberg < 8.32.0 contains a server side request forgery caused by LibreOffice fetching embedded external URLs without content inspection in /forms/libreoffice/convert, letting remote attackers perform SSRF, exploit requires uploading crafted documents.

Severity & Score

Severity: High

CVSS Score: 8.2

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Attackers can make LibreOffice fetch arbitrary external URLs, potentially accessing internal resources or causing network interactions.

Mitigation

Update to version 8.32.0 or later.

References

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rm4c-xj6x-49mw

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

May 14, 2026

🟠 CVE-2026-42591 - High (8.2) Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetch... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42591/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

May 14, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-42591
Severity: High
CVSS Score: 8.2
Type: server_side_request_forgery
Status: unconfirmed
EPSS: 0.0%
Social Posts: 2

CWE

CWE-918

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score

0.0%Probability of exploitation in the next 30 days