Executive brief
Gotenberg is a specialized tool used to convert various file formats into PDFs via a web API. A security flaw in its metadata processing allows an attacker to manipulate how files are saved within the system. By sending a specially crafted request, an unauthenticated user could move, rename, or overwrite critical system files, potentially leading to a complete service disruption or unauthorized system modifications.
Technical details
The vulnerability exists in the metadata write endpoint where metadata values are not properly sanitized before being passed to ExifTool via the go-exiftool library. While a previous fix (v8.30.1) implemented sanitization for metadata keys, it failed to sanitize metadata values. An attacker can inject a newline character (\n) into a metadata value, which causes the underlying line-based stdin protocol of ExifTool to interpret the subsequent data as new command-line arguments. This allows the injection of dangerous pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. Exploitation can lead to arbitrary file overwrites or the creation of symlinks/hardlinks within the container. The issue is addressed in version 8.31.0.
Affected products
- Gotenberg Gotenberg <= 8.30.1
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-06: disclosed: CVE-2026-40281 published to NVD
- 2026-05-11: patched: NVD analysis and CPE information updated