Home / Vulnerability Intelligence / CVE-2026-42595

CVE-2026-42595 - Vulnerability Analysis

HighCVSS: 8.6

Last Updated: May 14, 2026

Gotenberg - Server Side Request Forgery

Published: May 14, 2026Updated: May 14, 2026Remote Exploitable

Overview

Gotenberg < 8.32.0 contains a server side request forgery caused by insufficient deny-list validation and redirect handling in Chromium URL-to-PDF endpoint, letting unauthenticated attackers access internal network resources, exploit requires no authentication.

Severity & Score

Severity: High

CVSS Score: 8.6

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Unauthenticated attackers can access internal network resources and cloud metadata, potentially exposing sensitive information.

Mitigation

Update to version 8.32.0 or later.

References

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-chwh-f6gm-r836

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

May 14, 2026

🟠 CVE-2026-42595 - High (8.6) Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/forms/chromium/convert/url) has no default protection against HTTP/HTTPS-based SSRF. The default deny-list regex only blocks fil... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42595/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

May 14, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-42595
Severity: High
CVSS Score: 8.6
Type: server_side_request_forgery
Status: unconfirmed
EPSS: 0.0%
Social Posts: 2

CWE

CWE-918

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score

0.0%Probability of exploitation in the next 30 days