CVE-2026-27018

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada thecodingmachine gotenberg. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Gotenberg is an API for converting document formats. Prior to version 8.29.0, the fix introduced for CVE-2024-21527 can be bypassed using mixed-case or uppercase URL schemes. This issue has been patched in version 8.29.0.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-jjwv-57xh-xr6r exploit · mitigasi · advisory vendor
• https://github.com/gotenberg/gotenberg/commit/06b2b2e10c52b58135edbfe82e94d599eb0c5a11 patch
• https://github.com/gotenberg/gotenberg/commit/8625a4e899eb75e6fcf46d28394334c7fd79fff5 patch
• https://github.com/gotenberg/gotenberg/releases/tag/v8.29.0 product · release notes