CVE-2026-40281 Details
Description
Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.
A vulnerability exists in Gotenberg, a Docker-based API for PDF files, in versions through 8.30.1. The issue arises in the metadata write endpoint, where metadata keys are validated for control characters, but values are left unsanitized. This allows an attacker to inject arbitrary ExifTool pseudo-tags by including a newline character in the metadata value, bypassing the key-sanitization fix implemented in v8.30.1. Exploitation of this vulnerability enables an unauthenticated attacker to manipulate PDF files being processed, potentially renaming or moving them to arbitrary locations within the container filesystem, overwriting files, or creating symbolic and hard links.
Users can update to Gotenberg version 8.31.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q | CISA-ADP | ExploitPatchVendor Advisory |
| https://github.com/gotenberg/gotenberg/commit/405f1069c026bb08f319fb5a44e5c67c33208318 | [email protected] | Patch |
| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| thecodingmachine gotenberg | < 8.31.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | New CVE Received | [email protected] |