gotenberg — Vulnerabilities & Security Advisories 19

Gotenberg is an API for converting HTML, Markdown, and Office documents to PDF, primarily used for document processing in web applications. Historically, it has been vulnerable to remote code execution (RCE) through template injection, cross-site scripting (XSS) via malicious document content, and privilege escalation through insecure default configurations. The project has addressed multiple CVEs, including RCE flaws in template processing and XSS vulnerabilities in document rendering. While no major public security incidents have been documented, the consistent pattern of template-related RCE vulnerabilities suggests that input validation and sandboxing remain critical areas for secure deployment.