7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40280

CVE-2026-40280: Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data/.

This bypasses the same security control that was patched in CVE-2026-27018.

This issue has been fixed in version 8.31.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40280

CVE-2026-40280:

7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gotenberg/gotenberg/v8	go	<= 8.30.1	8.31.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) bypass in Gotenberg version 8.30.1 and earlier. The root cause is the use of a case-sensitive regular expression to validate URLs against a deny-list. An attacker can bypass this check by using uppercase characters in the URL scheme (e.g., HTTP:// instead of http://). The underlying Go HTTP client normalizes the URL scheme to lowercase before making the request, thus allowing the request to internal services that are supposed to be blocked.

The patch, identified in commit 924576d3d4c5f05b3aabcb9365cb50a646d9eaf6, addresses this by introducing a new function, FilterOutboundURL, which normalizes the URL scheme to lowercase before performing any validation. The patch replaces all calls to the previously used vulnerable function, FilterDeadline, with the new, secure function.

The analysis of the patch identified four key functions that were calling the vulnerable FilterDeadline function and are therefore the entry points for this SSRF vulnerability:

newContext in pkg/modules/api/context.go for handling downloadFrom URLs.
webhookMiddleware in pkg/modules/webhook/middleware.go for handling webhook URLs.
chromiumBrowser.do in pkg/modules/chromium/browser.go for handling the main URL for conversion.
listenForEventRequestPaused in pkg/modules/chromium/events.go for handling sub-requests within a page.

An attacker exploiting this vulnerability could make the server access internal network services, potentially leading to information disclosure or further attacks on the internal network.

Vulnerable functions

newContext

pkg/modules/api/context.go

The function `newContext` was vulnerable to Server-Side Request Forgery (SSRF). It used the `FilterDeadline` function to validate URLs from the 'downloadFrom' parameter. `FilterDeadline` performed a case-sensitive regex match on the URL, which could be bypassed by providing a URL with an uppercase scheme like 'HTTP://'. The Go HTTP client would then lowercase the scheme before making the request, allowing an attacker to access internal resources.

webhookMiddleware

pkg/modules/webhook/middleware.go

The `webhookMiddleware` function was vulnerable to Server-Side Request Forgery (SSRF). It used the `FilterDeadline` function to validate webhook URLs. `FilterDeadline` performed a case-sensitive regex match, which an attacker could bypass by using an uppercase URL scheme (e.g., 'HTTP://'). This would cause the application to make requests to internal network resources that should have been blocked by the deny-list.

chromiumBrowser.do

pkg/modules/chromium/browser.go

The `do` method of `chromiumBrowser` was vulnerable to Server-Side Request Forgery (SSRF). It used the `FilterDeadline` function to validate the main URL to be converted. This validation could be bypassed using a case-insensitive URL scheme (e.g., 'HTTP://'), allowing the headless browser to navigate to and render content from internal network locations.

listenForEventRequestPaused

pkg/modules/chromium/events.go

The `listenForEventRequestPaused` function was vulnerable to Server-Side Request Forgery (SSRF). It validated URLs for sub-requests made by a page (e.g., iframes, images) using the flawed `FilterDeadline` function. An attacker could craft a page that loads resources from internal URLs using an uppercase scheme (e.g., 'HTTP://') to bypass the deny-list.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.