Affected by GO-2026-4990 and 6 other vulnerabilities

GO-2026-4990: Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes in github.com/gotenberg/gotenberg

GO-2026-5080: Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes in github.com/gotenberg/gotenberg

GO-2026-5162: Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move in github.com/gotenberg/gotenberg

GO-2026-5234: Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist in github.com/gotenberg/gotenberg

GO-2026-5244: Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes in github.com/gotenberg/gotenberg

GO-2026-5627: Gotenberg has a Server-Side Request Forgery (SSRF) Issue in github.com/gotenberg/gotenberg

GO-2026-5636: Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg

standard

package

v8.35.0 Latest Latest Go to latest Published: Aug 7, 2026 License: MIT Imports: 12 Imported by: 1

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/gotenberg/gotenberg

Links

Open Source Insights

Documentation ¶

Overview ¶

Package standard imports the default modules.

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
chromium Package chromium imports modules for the Chromium-only variant (no LibreOffice).	Package chromium imports modules for the Chromium-only variant (no LibreOffice).
libreoffice Package libreoffice imports modules for the LibreOffice-only variant (no Chromium).	Package libreoffice imports modules for the LibreOffice-only variant (no Chromium).

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL