CVE-2026-55229: Gotenberg LibreOffice SSRF Vulnerability

CVE-2026-55229 Overview

CVE-2026-55229 is a Server-Side Request Forgery (SSRF) vulnerability in Gotenberg, a Docker-powered stateless API for PDF file generation. The flaw affects the /forms/libreoffice/convert endpoint in versions prior to 8.34.0. A specially crafted document forces LibreOffice to fetch external HTTP(S) resources and local file resources during conversion. Attackers can trigger blind SSRF and read limited local files through linked image resource loading. The issue is tracked under [CWE-918] and is fixed in Gotenberg 8.34.0.

Critical Impact
Unauthenticated attackers who can submit documents to a Gotenberg instance can pivot to internal network resources and disclose local file contents through document conversion.

Affected Products

Gotenberg versions prior to 8.34.0
Deployments exposing the /forms/libreoffice/convert endpoint
Containerized Gotenberg services with network access to internal resources

Discovery Timeline

2026-07-10 - CVE-2026-55229 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55229

Vulnerability Analysis

Gotenberg wraps LibreOffice to convert documents into PDFs. LibreOffice's Universal Content Broker (UCB) fetches external content referenced by documents, including OOXML images marked with TargetMode="External", RTF INCLUDEPICTURE fields, and ODT linked images. Gotenberg attempted to route those fetches through an in-process proxy that applied SSRF filters used by the Chromium and webhook paths.

However, LibreOffice's libcurl can also perform direct fetches and can resolve absolute file paths such as file:///etc/passwd. These code paths bypassed the in-process proxy, allowing linked resources to load without SSRF filtering. An attacker submitting a crafted document can force outbound requests to internal endpoints or read local files referenced by image links.

Root Cause

The root cause is missing enforcement of trust boundaries on linked content during LibreOffice conversion. The proxy configuration routed HTTP and HTTPS traffic but did not block file:// URIs or direct fetches originating from documents in untrusted locations. LibreOffice resolved every linked reference at conversion time.

Attack Vector

An unauthenticated attacker uploads a crafted document to the /forms/libreoffice/convert endpoint. The document contains a linked image referencing an internal URL such as http://169.254.169.254/latest/meta-data/ or a local path such as file:///etc/hostname. During conversion, LibreOffice fetches the resource, enabling blind SSRF against internal services and limited file disclosure through image loading side effects.

// Security patch in pkg/modules/libreoffice/api/proxy.go
// feat(libreoffice): block linked content from untrusted locations

// sofficeProfileConfigTmpl is the registrymodifications.xcu the soffice
// daemon loads at startup. It does two things:
//
//  1. Routes every HTTP and HTTPS fetch through proxyHost:proxyPort so
//     soffice's own libcurl fetches hit the in-process SSRF proxy.
//  2. Sets BlockUntrustedRefererLinks so soffice refuses to load content
//     linked from a document that sits in an untrusted location.
//
// The second setting closes the local-read and direct-fetch vectors the
// proxy cannot see. A document that links an absolute path
// (file:///etc/...) or any URL is loaded from the per-request temp dir,
// which is never a trusted location, so soffice drops the linked content
// instead of resolving it. Embedded content (stored inside the document)
// is unaffected.
const sofficeProfileConfigTmpl = `<?xml version="1.0" encoding="UTF-8"?>
<oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="BlockUntrustedRefererLinks" oor:op="fuse"><value>true</value></prop></item>
  <item oor:path="/org.openoffice.Inet/Settings"><prop oor:name="ooInetProxyType" oor:op="fuse"><value>1</value></prop></item>

Source: GitHub Commit 98fc403

Detection Methods for CVE-2026-55229

Indicators of Compromise

Outbound HTTP(S) requests from Gotenberg containers to internal IP ranges, cloud metadata endpoints (169.254.169.254), or unexpected external hosts during document conversion.
LibreOffice conversion jobs referencing documents that contain TargetMode="External" relationships, RTF INCLUDEPICTURE fields, or ODT linked images pointing to non-local resources.
File access attempts by the soffice process against sensitive paths such as /etc/passwd, /proc/self/environ, or Kubernetes service account tokens.

Detection Strategies

Inspect submitted documents for linked image relationships that resolve to remote URLs or absolute file:// paths before forwarding to Gotenberg.
Monitor Gotenberg container network egress and alert on connections that do not match expected downstream services.
Correlate /forms/libreoffice/convert request logs with unusual outbound DNS lookups or connections initiated by the soffice child process.

Monitoring Recommendations

Enable container-level network flow logging for Gotenberg workloads and baseline normal conversion traffic.
Track LibreOffice conversion durations and error rates for anomalies that may indicate blind SSRF probing.
Forward Gotenberg access logs and container process telemetry to a centralized data lake for retrospective hunting.

How to Mitigate CVE-2026-55229

Immediate Actions Required

Upgrade Gotenberg to version 8.34.0 or later, which introduces BlockUntrustedRefererLinks and routes libcurl fetches through the SSRF proxy.
Restrict network egress from Gotenberg containers using network policies or egress firewalls that block access to metadata services and internal-only ranges.
Place Gotenberg behind an authenticated gateway if it is currently reachable by untrusted clients.

Patch Information

The fix is available in Gotenberg 8.34.0. Details are documented in the GitHub Security Advisory GHSA-2mrg-35hw-x3x9 and the GitHub Release v8.34.0. The patch renames sofficeProxyConfig to sofficeProfileConfig and adds the BlockUntrustedRefererLinks setting so LibreOffice refuses to resolve linked content stored in per-request temp directories.

Workarounds

Apply strict egress network policies that deny Gotenberg containers access to internal subnets, cloud metadata endpoints, and the loopback interface where unnecessary.
Pre-process submitted documents to strip external image relationships and file:// links before invoking /forms/libreoffice/convert.
Run Gotenberg with a read-only root filesystem and minimal mounted volumes so local file disclosure has limited scope.

bash

# Example Kubernetes NetworkPolicy limiting Gotenberg egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: gotenberg-egress-restrict
spec:
  podSelector:
    matchLabels:
      app: gotenberg
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - protocol: TCP
          port: 443