Versions of github.com/gotenberg/gotenberg v8 packages prior to 8.1.0, including the main package and modules chromium and webhook, are vulnerable to SSRF through the /convert/html endpoint. An attacker can exploit this by requesting files via localhost (e.g., using an iframe with src="\\localhost/etc/passwd"), resulting in local file inclusion and unauthorized reading of sensitive host files. The vulnerability has a CVSS 4.0 score of 8.8, indicating high severity. The vendor has not explicitly published a patch or official remediation, but a workaround using --chromium-deny-list and --chromium-allow-list flags is suggested.

Successful exploitation allows an attacker to perform local file inclusion on the host system, potentially exposing sensitive files. This can lead to information disclosure and further compromise depending on the contents of the accessed files. The vulnerability is remotely exploitable without authentication and requires no user interaction.

No official patch or fix is confirmed from the provided data; patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a workaround, users can apply the --chromium-deny-list and/or --chromium-allow-list flags to restrict or control Chromium's network requests and mitigate SSRF exploitation via the /convert/html endpoint.