6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39383

CVE-2026-39383: Gotenberg unauthenticated blind SSRF via unfiltered webhook URL

Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url request header. The FilterDeadline function in filter.go is intended to gate outbound URLs, but when both the allow-list and deny-list are empty (the default configuration), it returns nil unconditionally and permits any URL.

This is a blind SSRF: Gotenberg POSTs the converted document to the webhook URL and only checks whether the response status code is an error, but never returns the target's response body to the attacker. An attacker can use this to probe internal network infrastructure by observing whether the error callback is invoked, force POST requests against internal services that perform side effects, and confirm reachability of cloud metadata endpoints. The retryable HTTP client issues up to 4 automatic retries per request, amplifying each probe.

This issue has been fixed in version 8.31.0. As a workaround, configure the GOTENBERG_API_WEBHOOK_ALLOW_LIST environment variable to restrict webhook URLs to known receivers, or set GOTENBERG_API_WEBHOOK_DENY_LIST to block RFC-1918 and link-local address ranges.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39383

CVE-2026-39383:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gotenberg/gotenberg/v8	go	>= 8.29.1, < 8.31.0	8.31.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in Gotenberg, identified as GHSA-5vh4-rgv7-p9g4. The root cause lies in the gotenberg.FilterDeadline function, which was used to validate user-supplied URLs across different modules. This function had an insecure default behavior: when the URL allow and deny lists were empty (the default configuration), it permitted any URL to pass through. This "fail-open" logic created multiple SSRF vectors.

The primary vector, as demonstrated in the proof-of-concept, is through the webhook feature. The webhook.webhookMiddleware function used FilterDeadline to validate the URL provided in the Gotenberg-Webhook-Url header. An attacker could abuse this to make Gotenberg send POST requests to arbitrary internal or external destinations.

However, the analysis of the patch that fixes this vulnerability reveals that the same flawed validation logic was used in other parts of the application, creating additional SSRF vectors:

API Downloads: The api.newContext function used FilterDeadline to validate URLs for the file download feature.
Chromium URL Conversion: The chromium.(*chromiumBrowser).do method used it to validate the main URL for PDF conversion.
Chromium Asset Fetching: The chromium.listenForEventRequestPaused function used it to validate URLs of sub-resources (like images or scripts) fetched during page rendering.

The fix, introduced in version 8.31.0, was comprehensive. It involved creating a new, secure validation function, gotenberg.FilterOutboundURL, which, in addition to regex-based filtering, resolves the URL's hostname and explicitly checks if the resulting IP address is a non-public one (e.g., RFC1918, loopback). All the identified vulnerable functions were updated to use this new secure function, and the underlying HTTP clients were hardened to use a new secureDialContext, effectively mitigating the SSRF risk across the application.

Vulnerable functions

webhook.webhookMiddleware

pkg/modules/webhook/middleware.go

This middleware processes the `Gotenberg-Webhook-Url` and `Gotenberg-Webhook-Error-Url` headers. Before the patch, it used the `FilterDeadline` function for URL validation. `FilterDeadline` was insecure by default, as it permitted any URL when the allow/deny lists were not configured, leading to a Server-Side Request Forgery (SSRF) vulnerability. An attacker could supply a malicious URL pointing to an internal service.

api.newContext

pkg/modules/api/context.go

This function is responsible for handling file downloads from a user-provided URL (`download_from` feature). It used the vulnerable `FilterDeadline` function to validate the URL, creating an SSRF vector similar to the webhook vulnerability. The patch replaces the call with the secure `FilterOutboundURL` function.

chromium.(*chromiumBrowser).do

pkg/modules/chromium/browser.go

This method handles the conversion of a given URL to a PDF. The URL provided by the user was validated using the insecure `FilterDeadline` function. This allowed an attacker to specify an internal URL for conversion, potentially leading to information disclosure or interaction with internal services. The fix involves switching to the more secure `FilterOutboundURL` function.

chromium.listenForEventRequestPaused

pkg/modules/chromium/events.go

When rendering a web page for PDF conversion, Chromium may request sub-resources (e.g., images, scripts). This function intercepts those requests to validate their URLs. It previously used `FilterDeadline`, which failed to block requests to internal resources by default. This could be exploited by a malicious page to perform SSRF attacks from within the context of the page rendering.

gotenberg.FilterDeadline

pkg/gotenberg/filter.go

This is the root cause of the vulnerability. While not directly called by user code, its insecure "fail-open" logic is what introduces the SSRF vulnerability in its callers. It incorrectly assumes that an empty allow/deny list means no filtering is needed, while it should default to a secure, deny-all stance. The patches replace calls to this function with a new, secure alternative.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.