CVE-2026-55229 Details.
Gotenberg < 8.34.0 - Local File Disclosure
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-55229. What It Means.
Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document (such as a:blip r:link TargetMode="External") can instruct LibreOffice to fetch local resources (file://) or remote resources (http/https), which are then included as images in the generated PDF. This can disclose the contents of local files LibreOffice can o…
Affected Product. What Is Hit.
- Vendor
- gotenberg
- Product
- Gotenberg
FAQ
Common Questions.
Gotenberg < 8.34.0 - Local File Disclosure. Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document (such as a:blip r:link TargetMode="External") can instruct LibreOffice to fetch local resources (file://) or remote resources (http/https), which are then included as images in the generated PDF. This can disclose the contents of local files LibreOffice can o…
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-55229 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-55229 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Gotenberg to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-55229. Atlas does not run a check for it, so nothing here says whether a particular site is affected.