A path traversal vulnerability in Gotenberg allows potential unauthorized access to files, necessitating an immediate update to version 8.33.0.

This is a path traversal vulnerability (CWE-22) that allows an attacker to escape intended directory restrictions. The CVSS vector notes that this vulnerability requires user interaction and is accessible via the network, potentially leading to unauthorized file disclosure.

An attacker could leverage this vulnerability to read sensitive configuration files or other data stored on the server, leading to information disclosure and potentially further system compromise. While the CVSS score is 8.8, the requirement for user interaction slightly modifies the attack flow, but the impact remains critical for environments handling sensitive documents.

Immediate Action: Update the Gotenberg container image to version 8.33.0 or later to resolve the path traversal flaw.

Proactive Monitoring: Review application logs for suspicious file path patterns or requests containing directory traversal sequences such as double dots (../) in API calls.

Compensating Controls: Ensure that the Gotenberg container is running with the principle of least privilege, specifically utilizing read-only file systems and restricted container capabilities to limit the impact of potential traversal.

Public Exploit Available: exploit_available (unknown)

Users of the Gotenberg API should immediately upgrade to version 8.33.0 to mitigate the risk of file system traversal. Failure to update leaves the deployment vulnerable to unauthorized data access by malicious actors.