Vulnerability in Gotenberg
CVE-2026-40281
Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (49.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.000
Affected products
- Gotenberg — versions <= 8.30.1
- Thecodingmachine Gotenberg
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q (Exploit, Patch, Vendor Advisory)
- github.com/gotenberg/gotenberg/commit/405f1069c026bb08f319fb5a44e5c67c33208318 (Patch)
Frequently asked questions
- What is CVE-2026-40281?
- CVE-2026-40281 is a critical-severity vulnerability in Gotenberg, classified under Argument Injection. CVSS score: 10.0/10. Published 2026-05-06.
- How severe is CVE-2026-40281?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2026-40281 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.