PT-2026-38381 · Gotenberg · Gotenberg

Johanneslks · Published 2026-05-07 · Updated 2026-06-25 · CVE-2026-42590

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.30.0

Description The ExifTool metadata write blocklist can be bypassed using group-prefix syntax, allowing an attacker to perform arbitrary file rename, move, hardlink, and symlink creation on the server. The safeKeyPattern regex allows colons, enabling prefixed tag names like File:FileName to pass validation and be processed identically to the blocked tags. Additionally, the pseudo-tags FilePermissions, FileUserID, and FileGroupID are not blocked, allowing the modification of file attributes. This issue affects the '/forms/pdfengines/metadata/write' endpoint via the metadata parameter. In environments with mounted volumes or non-containerized setups, this can lead to arbitrary file read through symlink chaining and file overwrite via directory manipulation.

Recommendations Update to version 8.30.0.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-42590

GHSA-7V3R-M9C8-R855

GO-2026-5234

Affected Products

Gotenberg

References · 9

• 🔥 https://github.com/gotenberg/gotenberg/security/advisories/GHSA-7v3r-m9c8-r855 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42590 · Security Note
• https://osv.dev/vulnerability/GHSA-7v3r-m9c8-r855 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5234 · Vendor Advisory
• https://github.com/gotenberg/gotenberg · Note
• https://t.me/CVEtracker/53790 · Telegram Post
• https://github.com/advisories/GHSA-qmwh-9m9c-h36m · Note
• https://t.me/cveNotify/163840 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2054970030207512882 · Twitter Post