CVE-2026-42589 Details
Description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded in a JSON key splits the ExifTool stdin stream into a new argument line, allowing an attacker to inject arbitrary ExifTool flags — including -if, which evaluates Perl expressions. This achieves unauthenticated OS command execution in a single HTTP request. The response is HTTP 200 with a valid PDF, making the attack transparent to basic monitoring. This vulnerability is fixed in 8.31.0.
A remote code execution vulnerability has been identified in Gotenberg versions prior to 8.31.0. The issue arises in the '/forms/pdfengines/metadata/write' HTTP endpoint, where JSON metadata keys are passed directly to ExifTool without proper validation. An attacker can inject arbitrary ExifTool flags by embedding a newline character in the JSON key, splitting the ExifTool stdin stream and allowing execution of malicious commands. This vulnerability is particularly concerning as it can be exploited in a single HTTP request, with the response appearing normal, thus evading basic monitoring.
Users are advised to update Gotenberg to version 8.31.0 or later. Additionally, Gotenberg should be placed behind an authenticated reverse proxy and not exposed directly to untrusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rqgh-gxv4-6657 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rqgh-gxv4-6657 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| thecodingmachine gotenberg | < 8.31.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |