CVE-2026-40280
- Source
- https://cve.org/CVERecord?id=CVE-2026-40280
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40280.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-40280
- Aliases
- Related
- Published
- 2026-05-05T19:52:40.327Z
- Modified
- 2026-07-08T08:29:24.387960148Z
- Severity
-
- 7.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N CVSS Calculator
- Summary
- Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists
- Details
-
Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data/.
This bypasses the same security control that was patched in CVE-2026-27018.
This issue has been fixed in version 8.31.0.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40280.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-918" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40280.json
- https://github.com/advisories/GHSA-jjwv-57xh-xr6r
- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5q7p-7jgv-ww56
- https://nvd.nist.gov/vuln/detail/CVE-2026-40280
- https://github.com/gotenberg/gotenberg/commit/3f01ca18d3cc21375a1e2da4b5a3f261c8548e47
Affected packages
Git / github.com/gotenberg/gotenberg
Affected ranges
- Type
- GIT
- Repo
- https://github.com/gotenberg/gotenberg
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
{ "cpe": "cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*", "source": [ "CPE_RANGE", "REFERENCES" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "8.31.0" } ] }