Gotenberg

v8.34.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo API Development

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

api chrome chromium convert-to-pdf docker docx-to-pdf

+14 more

excel exiftool html-to-pdf libreoffice openoffice pdf pdf-converter pdftk puppeteer qpdf screenshots unoconv wkhtmltopdf word

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 1mo

The update blocks content from untrusted locations in LibreOffice, preventing SSRF and local file reads.

Why it matters: Blocks SSRF and local‑file read attacks on the LibreOffice conversion process; severity score 90 indicates critical risk.

Summary

AI summary

Updates Bug Fixes, New Features, and Observability across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Blocks content linked from untrusted locations in LibreOffice, preventing SSRF and local file reads. Blocks content linked from untrusted locations in LibreOffice, preventing SSRF and local file reads. Source: llm_adapter@2026-06-12 Confidence: high	—
Feature
Feature	Medium	Adds Factur-X / ZUGFeRD metadata injection and dedicated API form fields for conversions. Adds Factur-X / ZUGFeRD metadata injection and dedicated API form fields for conversions. Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Medium	Introduces owner‑only encryption via `ownerPassword` and permission controls for PDFs. Introduces owner‑only encryption via `ownerPassword` and permission controls for PDFs. Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Low	Adds `log-std-level-case` flag to set log level casing (`lower` or `upper`). Adds `log-std-level-case` flag to set log level casing (`lower` or `upper`). Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Low	Enriches traces with process execution spans, supervisor sub‑spans, binary versions, and I/O metrics. Enriches traces with process execution spans, supervisor sub‑spans, binary versions, and I/O metrics. Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Low	Classifies Chromium and LibreOffice errors with a bounded `error.type` enum in traces. Classifies Chromium and LibreOffice errors with a bounded `error.type` enum in traces. Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Low	Adds richer resource detectors, semconv alignment, exemplar filter, and conversion‑since‑restart/queue‑depth gauges. Adds richer resource detectors, semconv alignment, exemplar filter, and conversion‑since‑restart/queue‑depth gauges. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix
Bugfix	Medium	Suppresses CSV conversion from leaking the upload's UUID filename as a page header. Suppresses CSV conversion from leaking the upload's UUID filename as a page header. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Preserves trace context in webhook async delivery goroutine. Preserves trace context in webhook async delivery goroutine. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Installs missing `ca-certificates` package in chromium‑only image, fixing outbound TLS failures. Installs missing `ca-certificates` package in chromium‑only image, fixing outbound TLS failures. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Caps and observes retries on LibreOffice core-dump errors and corrects `ErrRuntimeException` message. Caps and observes retries on LibreOffice core-dump errors and corrects `ErrRuntimeException` message. Source: granite4.1:30b@2026-06-12-audit Confidence: low	—

Full changelog

Security Fixes ⚠️

Block content linked from untrusted locations in LibreOffice. An uploaded document could reference external (http(s)://) or local (file:///…) resources that LibreOffice resolved during conversion, giving blind SSRF and a limited local-file read. The soffice profile now sets BlockUntrustedRefererLinks, so soffice refuses to load any content a document links. Embedded content is unaffected; documents relying on linked resources no longer render them.

New Features

Factur-X / ZUGFeRD metadata (#1552). Conversions now inject the matching XMP metadata, and the API replaces the single facturx payload with dedicated form fields. Thanks @fank.
Owner-only encryption and permissions. A new ownerPassword, independent of userPassword, plus permission controls restrict what a viewer may do without locking the document open.
log-std-level-case (#1339). New flag to set the level field casing in standard output, lower (default) or upper. Thanks @Jaben.

Observability

Trace enrichment. New process.exec client spans, supervisor queue-wait and launch sub-spans, a Chromium print_to_pdf sub-span, backing-binary versions (Chromium, LibreOffice, qpdf, …) recorded on spans and captured at build time, and per-conversion I/O, network, and size attributes on Chromium and LibreOffice spans.
Error classification. Chromium and LibreOffice failures set an error.type from a bounded enum.
Richer resource and metrics. Process, OS, host, and container resource detectors, semconv aligned to v1.41.0, a trace-based exemplar filter, and conversions-since-restart and queue-depth gauges.

Bug Fixes

CSV conversions leaked the upload's UUID filename as a page header (#1568). Calc printed the sheet name, which was the UUID-based upload filename, as a centered page header. Now suppressed. Thanks @vapranav.
Webhook async lost trace context. The async delivery goroutine detached from the request context and dropped the trace, breaking span continuity. It now preserves the context via context.WithoutCancel.
ca-certificates missing in the chromium-only image. Outbound TLS could fail in the chromium-only build. The package is now installed. Thanks @osvein.
LibreOffice core-dump retries. Retries on ErrCoreDumped are now capped and observable, and the ErrRuntimeException message is corrected.

Chore

Updated Chromium to version 149.0.7827.102-1.
Updated Go dependencies.

Security Fixes

CVE‑2024‑XXXXX – Block content linked from untrusted locations in LibreOffice prevents blind SSRF and limited local‑file reads

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Gotenberg

Get notified when new releases ship.

About Gotenberg

Developer-friendly API to interact with powerful tools like Chromium and LibreOffice for converting numerous document formats (HTML, Markdown, Word, Excel, etc.) into PDF files, and more.

All releases →