Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gotenberg/gotenberg/v8 | go | < 8.34.0 | 8.34.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) within the LibreOffice module of Gotenberg, occurring during document conversion via the /forms/libreoffice/convert endpoint. The root cause is an insecure configuration of the underlying LibreOffice process, which permitted it to fetch external resources (e.g., images) referenced in the documents. This could be exploited by a malicious actor to make the server issue requests to arbitrary external or internal URLs.
The analysis of the patch that fixes this vulnerability (commit 98fc40347885ad510a311b990a73397c6d4143db) reveals that the flaw lies in the setup of the LibreOffice process. Specifically, the function writeSofficeProxyConfig in pkg/modules/libreoffice/api/proxy.go was responsible for creating the configuration file for LibreOffice. This configuration was missing a crucial security setting, BlockUntrustedRefererLinks.
The patch replaces writeSofficeProxyConfig with writeSofficeProfileConfig, which adds this security setting to the configuration file, effectively preventing LibreOffice from loading linked content from untrusted locations.
The libreOfficeProcess.Start function in pkg/modules/libreoffice/api/libreoffice.go is the function that initiates the LibreOffice process and calls the configuration writing function. Before the patch, it was responsible for applying the insecure configuration.
Therefore, the vulnerable functions are writeSofficeProxyConfig (as it existed before the patch) and libreOfficeProcess.Start for its role in applying the vulnerable configuration. While the user-facing endpoint is /forms/libreoffice/convert, these two functions are the core of the vulnerability as they establish the insecure environment that allows the SSRF to occur.
libreOfficeProcess.Startpkg/modules/libreoffice/api/libreoffice.go
writeSofficeProxyConfigpkg/modules/libreoffice/api/proxy.go