Gotenberg - SSRF (CVE-2026-40280)

CVE-2026-40280 is a server-side request forgery (SSRF) vulnerability in Gotenberg 8.30.1 and earlier that allows unauthenticated attackers to bypass private-IP deny-lists by using mixed- or uppercase URL schemes. Successful exploitation can expose internal services, loopback systems, private network resources, and cloud instance metadata endpoints, potentially enabling reconnaissance and access to sensitive internal information. The issue is fixed in Gotenberg 8.31.0.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-40280 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2026-40280 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target Gotenberg’s /forms/chromium/convert/html endpoint and abuse the multipart downloadFrom parameter to induce server-side requests to attacker-controlled or internal URLs. Mixed-case schemes such as HTTP:// or HTTPS:// can bypass case-sensitive deny-lists, enabling unauthenticated access to private services, loopback addresses, and cloud metadata endpoints.