PT-2026-38384 · Gotenberg · Gotenberg

Adrgs · Published 2026-05-07 · Updated 2026-05-14 · CVE-2026-42593

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.32.0

Description Six API endpoints ('/pdfengines/merge', '/pdfengines/split', '/libreoffice/convert', '/chromium/convert/url', '/chromium/convert/html', and '/chromium/convert/markdown') allow anonymous callers to read PDF files from the container filesystem. The issue occurs because these endpoints do not properly validate the stampExpression and watermarkExpression variables when no file is uploaded, but the stampSource or watermarkSource variables are set to 'pdf'. This allows an attacker to specify an arbitrary file path, which is then processed by the pdfcpu tool and returned to the caller as a composite PDF. This can be used to access sensitive PDF documents that the Gotenberg process has permissions to read, including those in bind-mounted host directories.

Recommendations Update to version 8.32.0. As a temporary workaround, restrict access to the affected API endpoints to trusted users only.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-42593

GHSA-3CV5-Q585-H563

Affected Products

Gotenberg

References · 5

• 🔥 https://github.com/gotenberg/gotenberg/security/advisories/GHSA-3cv5-q585-h563 · Exploit
• https://osv.dev/vulnerability/GHSA-3cv5-q585-h563 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42593 · Security Note
• https://github.com/gotenberg/gotenberg · Note
• https://t.me/CVEtracker/53793 · Telegram Post