shouldiuse.io

Categories

VERDICT

Gotenberg Review

Depends

Should I use Gotenberg?

A Docker-based API for PDF conversion - gotenberg.dev

· 7 hours ago

Buy if you have Docker and DevOps capacity and want free, self-hosted document conversion — developers genuinely like it. Skip if you want a managed SaaS or can't commit to fast security patching.

Confidence

Medium. Based on ~20 public sources; heavy 2026 security-advisory coverage, light formal review data.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Self-hosted open source

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Backend devs generating PDFs from HTML
  • Workflow automation (n8n, scripts)
  • Privacy-sensitive orgs needing self-hosting
  • Office-document-to-PDF pipelines

Not for

  • Non-technical teams wanting click-and-convert SaaS
  • Anyone without Docker and DevOps capacity
  • Teams that can't patch quickly after CVEs
  • Buyers needing vendor SLAs and support contracts

Gotchas - check before you buy

high

CVSS 10 unauthenticated RCE disclosed May 2026 — run latest release, never expose it publicly

high

Arbitrary PDF-read and auth-bypass flaws fixed only in recent versions; pin versions and track advisories

medium

TLS termination is your job — budget a reverse proxy or gateway

medium

Self-hosting means you own uptime, scaling, and patching; no vendor to call

Pros and cons

Pros

  • Completely free and open source — no per-conversion fees
  • Converts URLs, HTML, Markdown, and Office documents to PDF
  • Stateless design scales by adding containers
  • Works smoothly inside n8n automation workflows
  • Good results with minimal setup effort, per users

Cons

  • Checkered security record: five-plus 2026 CVEs
  • Requires Docker and DevOps comfort to deploy
  • No built-in HTTPS; reverse proxy required
  • ~700MB image feels heavy for a conversion service

Sources & method

- 10 sources - Multiple 2026 CVEs, including a CVSS 10 unauthenticated RCE — patch discipline is mandatory.

official x2review x3security x4news x1
  • CVE-2026-40281 — unauthenticated RCE, Argument injection flaw in versions 8.30.1 and earlier; rated CVSS 10 with file-overwrite impact.
  • CVE-2026-27018 — auth bypass, Authentication bypass in the Docker-powered stateless conversion API.
  • CVE-2026-40893 — improper file access control, PDF API validated only EXIF tags, allowing unintended file system access.
  • GHSA-3cv5-q585-h563 — arbitrary PDF read, Attacker could read any PDF the Gotenberg process can access on the container filesystem.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 5/5. Free and open source, zero per-conversion fees
  • Ease of use: 4/5. One container, simple API; some ops skill needed
  • Feature depth: 4/5. HTML, URL, Markdown, Office docs, screenshots
  • Support quality: 3/5. Community GitHub support only, no SLA
  • Security posture: 1/5. CVSS 10 RCE plus auth-bypass and file-read CVEs
  • Free License Open source, self-hosted Docker API
  • ~700MB Docker image size Per one user's report on X
  • 5+ 2026 CVEs found Auth bypass, file-read, RCE flaws
  • CVSS 10 Max severity Unauthenticated RCE, May 2026

Pricing

Self-hosted open source

Free

  • Full PDF conversion API
  • Docker image, runs anywhere
  • Community support only

Security

Multiple 2026 CVEs, including a CVSS 10 unauthenticated RCE — patch discipline is mandatory.

  • CVE-2026-40281 — unauthenticated RCEArgument injection flaw in versions 8.30.1 and earlier; rated CVSS 10 with file-overwrite impact.
  • CVE-2026-27018 — auth bypassAuthentication bypass in the Docker-powered stateless conversion API.⁴
  • CVE-2026-40893 — improper file access controlPDF API validated only EXIF tags, allowing unintended file system access.
  • GHSA-3cv5-q585-h563 — arbitrary PDF readAttacker could read any PDF the Gotenberg process can access on the container filesystem.⁵

What users say

Developers praise it as an effortless, reliable document-to-PDF converter but note the heavy Docker image.

“I use it constantly and generate PDF files from word documents and html pages.”
n8n community forum
“You'll have to create your own image and update the configuration file with your own command template”
Reddit, r/PHP
“Un Docker da 700MB non è forse la soluzione più snella, ma indubbiamente produce buoni risultati con uno sforzo minimo.”
X (Twitter), @madbob
Full analysis

Based on ~20 public sources; heavy 2026 security-advisory coverage, light formal review data.

Free, solid self-hosted PDF API devs love — but a 2026 CVSS 10 RCE means patch fast or get burned.

Methodology

Based on ~20 public sources; heavy 2026 security-advisory coverage, light formal review data.

Read how a report is made.

Sources

  1. Gotenberg official sitegotenberg.dev
    official
  2. Gotenberg HTTPS discussion #502github.com
    official
  3. CVSS 10 RCE and SSRF vulnerabilitiessecurityonline.info
    security
  4. CVE-2026-27018 Auth Bypasssentinelone.com
    security
  5. GHSA-3cv5-q585-h563 Arbitrary PDF readgithub.com
    security
  6. Gotenberg CVE listapp.opencve.io
    security
  7. n8n community recommendation threadcommunity.n8n.io
    review
  8. Reddit r/PHP client discussionreddit.com
    review
  9. PulseList directory listing (Free)thepulselist.com
    review
  10. Gotenberg vs IronPDF comparisonmedium.com
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.