PT-2026-36917 · Gotenberg · Gotenberg

Morimori-Dev · CVE-2026-40281 · Published 2026-04-30 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gotenberg versions 8.x through 8.30.1

Description An improper input validation issue exists in the metadata write endpoint '/forms/pdfengines/metadata/write'. While metadata keys are validated, metadata values are passed unsanitized to the WriteMetadata() function. An attacker can inject a newline character ( ) into a metadata value to split the ExifTool stdin line, allowing the injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink.

This can enable an unauthenticated attacker to rename or move processed PDFs to arbitrary paths in the container filesystem, overwrite system files, or create symlinks and hard links at arbitrary paths.

Recommendations Upgrade to version 8.31.0. As a temporary workaround, restrict access to the '/forms/pdfengines/metadata/write' endpoint to minimize the risk of exploitation.

Exploit

Fix

RCE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-40281

GHSA-Q7R4-HC83-HF2Q

GO-2026-5572

OPENSUSE-SU-2026:21483-1

Affected Products

Gotenberg

References · 1756

• 🔥 https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40281.json · Exploit
• https://github.com/gotenberg/gotenberg/commit/405f1069c026bb08f319fb5a44e5c67c33208318 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40281 · Security Note
• https://osv.dev/vulnerability/CVE-2026-40281 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5572 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q7r4-hc83-hf2q · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/gotenberg/gotenberg/releases/tag/v8.31.0 · Note
• https://github.com/gotenberg/gotenberg · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note