CVE-2026-27018

7.8 highEPSS 1.7%

High (7.8) in thecodingmachine gotenberg. EPSS 1.7% chance of exploitation in the next 30 days. Fixed in github.com/gotenberg/gotenberg/v8 8.29.0.

Gotenberg is an API for converting document formats. Prior to version 8.29.0, the fix introduced for CVE-2024-21527 can be bypassed using mixed-case or uppercase URL schemes. This issue has been patched in version 8.29.0.

Severity

CVSS 4.0

7.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWEs: CWE-22, CWE-918
Published: 2026-03-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

thecodingmachine:gotenberg

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-jjwv-57xh-xr6r	Go	github.com/gotenberg/gotenberg/v8	<8.29.0	8.29.0
GHSA-jjwv-57xh-xr6r	Go	github.com/gotenberg/gotenberg/v7	<=7.10.2	no fix published
GO-2026-4905	Go	github.com/gotenberg/gotenberg/v7	all versions	no fix published
GO-2026-4905	Go	github.com/gotenberg/gotenberg/v8	<8.29.0	8.29.0

References

Check your stack JSON