CVE-2026-27018: Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme
Vulnerability summary
CVE-2026-27018 is a high (CVSS 7.8) vulnerability in gotenberg. EPSS estimates a 1.70% chance of exploitation in the next 30 days, higher than 77.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 30-03-2026PublishedVulnerability first disclosed.
- 31-03-2026Last modifiedVulnerability information updated.
Description
Gotenberg is an API for converting document formats. Prior to version 8.29.0, the fix introduced for CVE-2024-21527 can be bypassed using mixed-case or uppercase URL schemes. This issue has been patched in version 8.29.0.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST7.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
1.70%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 1.63% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundGotenberg
Maturity: poc
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/gotenberg/gotenberg2 products
- v7≤ 7.10.2 | All versions (No fix recorded)
- v8< 8.29.0
Gotenberg1 product
- gotenberg< 8.29.0
Thecodingmachine1 product
- gotenberg< 8.29.0
3 vendors · 4 products
References
7 links- github.com/gotenberg/gotenberg/security/advisories/GHSA-jjwv-57xh-xr6rX Refsource CONFIRMWEBAdvisoryExploitMitigationVendor Advisory
- github.com/gotenberg/gotenberg/commit/06b2b2e10c52b58135edbfe82e94d599eb0c5a11X Refsource MISCWEBPatch
- github.com/gotenberg/gotenberg/commit/8625a4e899eb75e6fcf46d28394334c7fd79fff5X Refsource MISCWEBPatch
