CVE-2026-27018: Bypass in Gotenberg v8

An attacker can exploit this vulnerability by crafting malicious URLs with mixed-case or uppercase schemes (e.g., FILE:///etc/passwd). Because URI schemes are case-insensitive, Chromium, which Gotenberg uses for rendering, normalizes the scheme to lowercase before navigation. This bypasses the regex-based deny-list check, allowing the attacker to access files outside the intended safe zone. The potential impact includes reading sensitive configuration files, source code, or other data stored locally on the server. While the vulnerability doesn't directly lead to remote code execution, it significantly expands the attack surface and could be a stepping stone for further exploitation.

1. Reserved2026-02-17
2. Published2026-03-30
3. Modified2026-04-06
4. EPSS updated2026-04-07

The primary mitigation is to upgrade Gotenberg to version 8.29.0 or later, which includes the corrected regex filter. If upgrading immediately is not feasible, consider implementing a reverse proxy or WAF rule to block requests with uppercase or mixed-case URL schemes. Specifically, block requests containing FILE: or file: followed by any characters. Monitor Gotenberg logs for unusual file access attempts. After upgrading, confirm the fix by attempting to access a known restricted file using a mixed-case URL scheme (e.g., FILE:///etc/passwd); the request should be denied.