Skip to content

Commit f70d6f6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-44p7-9xx4-hf2g GHSA-jjwv-57xh-xr6r
1 parent 2485601 commit f70d6f6

2 files changed

Lines changed: 106 additions & 5 deletions

File tree

advisories/unreviewed/2026/03/GHSA-44p7-9xx4-hf2g/GHSA-44p7-9xx4-hf2g.json renamed to advisories/github-reviewed/2026/03/GHSA-44p7-9xx4-hf2g/GHSA-44p7-9xx4-hf2g.json

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-44p7-9xx4-hf2g",
4-
"modified": "2026-03-25T21:30:35Z",
4+
"modified": "2026-03-30T16:11:31Z",
55
"published": "2026-03-25T21:30:35Z",
66
"aliases": [
77
"CVE-2026-33809"
88
],
9+
"summary": "Go Images vulnerable to an out-of-memory error via a crafted TIFF file",
910
"details": "A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "golang.org/x/image"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.38.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33809"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://cs.opensource.google/go/x/image"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://go.dev/cl/757660"
@@ -33,10 +58,12 @@
3358
}
3459
],
3560
"database_specific": {
36-
"cwe_ids": [],
61+
"cwe_ids": [
62+
"CWE-770"
63+
],
3764
"severity": "MODERATE",
38-
"github_reviewed": false,
39-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-03-30T16:11:31Z",
4067
"nvd_published_at": "2026-03-25T19:16:51Z"
4168
}
4269
}

‎advisories/github-reviewed/2026/03/GHSA-jjwv-57xh-xr6r/GHSA-jjwv-57xh-xr6r.json‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jjwv-57xh-xr6r",
4+
"modified": "2026-03-30T16:16:07Z",
5+
"published": "2026-03-30T16:16:07Z",
6+
"aliases": [
7+
"CVE-2026-27018"
8+
],
9+
"summary": "Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)",
10+
"details": "### Impact\n\nThe fix introduced in version 8.1.0 for GHSA-rh2x-ccvw-q7r3 (CVE-2024-21527) can be bypassed using mixed-case or uppercase URL schemes.\n\nThe default `--chromium-deny-list` value is `^file:(?!//\\/tmp/).*`. This regex is anchored to lowercase `file:` at the start. However, per RFC 3986 Section 3.1, URI schemes are case-insensitive. Chromium normalizes the scheme to lowercase before navigation, so a URL like `FILE:///etc/passwd` or `File:///etc/passwd` bypasses the deny-list check but still gets resolved by Chromium as `file:///etc/passwd`.\n\nThe root cause is in `pkg/gotenberg/filter.go` — the `FilterDeadline` function compiles the deny-list regex with `regexp2.MustCompile(denied.String(), 0)`, where `0` means no flags (case-sensitive). Since the regex pattern itself doesn't include a `(?i)` flag, matching is strictly case-sensitive.\n\nThis affects both the URL endpoint and HTML conversion (via iframes, link tags, etc.).\n\n### Steps to Reproduce\n\n1. Start Gotenberg with default settings:\n\n```bash\ndocker run --rm -p 3000:3000 gotenberg/gotenberg:8.26.0 gotenberg\n```\n\n2. Read `/etc/passwd` via the URL endpoint using an uppercase scheme:\n\n```bash\ncurl -X POST 'http://localhost:3000/forms/chromium/convert/url' \\\n --form 'url=FILE:///etc/passwd' -o output.pdf\n```\n\n3. Open `output.pdf` — it contains the contents of `/etc/passwd`.\n\n4. Alternatively, create an `index.html`:\n\n```html\n<iframe src=\"FILE:///etc/passwd\" width=\"100%\" height=\"100%\"></iframe>\n```\n\nThen convert it:\n\n```bash\ncurl -X POST 'http://localhost:3000/forms/chromium/convert/html' \\\n -F 'files=@index.html' -o output.pdf\n```\n\n5. The resulting PDF contains `/etc/passwd` contents.\n\nMixed-case variants like `File:`, `fILE:`, `fiLE:` etc. all work as well.\n\n### Root Cause\n\n- `pkg/modules/chromium/chromium.go` defines the default deny-list as `^file:(?!//\\/tmp/).*`\n- `pkg/gotenberg/filter.go` compiles this with `regexp2.MustCompile(denied.String(), 0)` — flag `0` means case-sensitive\n- `pkg/modules/chromium/events.go` uses `FilterDeadline` to check intercepted request URLs against the deny-list\n- Chromium normalizes URL schemes to lowercase, so `FILE:///etc/passwd` becomes `file:///etc/passwd` after the deny-list check has already passed\n\n### Suggested Fix\n\nChange the default deny-list regex to use a case-insensitive flag:\n\n```\n(?i)^file:(?!//\\/tmp/).*\n```\n\nOr apply case-insensitive matching in `FilterDeadline` when compiling the regex.\n\n### Severity\n\nThis is effectively the same impact as CVE-2024-21527 — unauthenticated arbitrary file read from the Gotenberg container. An attacker can leak environment variables, configuration, credentials, and other sensitive data.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/gotenberg/gotenberg/v8"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "8.29.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-jjwv-57xh-xr6r"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rh2x-ccvw-q7r3"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/gotenberg/gotenberg/commit/06b2b2e10c52b58135edbfe82e94d599eb0c5a11"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/gotenberg/gotenberg/commit/8625a4e899eb75e6fcf46d28394334c7fd79fff5"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/gotenberg/gotenberg"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.29.0"
62+
}
63+
],
64+
"database_specific": {
65+
"cwe_ids": [
66+
"CWE-22",
67+
"CWE-918"
68+
],
69+
"severity": "HIGH",
70+
"github_reviewed": true,
71+
"github_reviewed_at": "2026-03-30T16:16:07Z",
72+
"nvd_published_at": null
73+
}
74+
}

0 commit comments

Comments
 (0)