CVE-2026-42589: Gotenberg OS command injection in PDF metadata write endpoint

CVE-2026-42589 · Severity: critical · CVSS 9.8 · Published 2026-05-14

Gotenberg is a tool used to convert various documents into PDF files via a web interface. A security flaw allows an unauthenticated attacker to execute malicious commands on the server by sending a specially crafted request to the metadata editing feature. This could lead to a total system takeover, data theft, or a foothold for further attacks within a corporate network, all while appearing as a successful, normal document process to monitoring tools.

Technologies: github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go), Gotenberg. Vendors: Go, Gotenberg.

Quick answers

Is CVE-2026-42589 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42589 being exploited in the wild.
How severe is CVE-2026-42589?
Critical severity, with a CVSS score of 9.8, published 14 May 2026.
Which products and versions are affected?
github.com/gotenberg/gotenberg/v7 (Go) SEMVER:introduced=0; github.com/gotenberg/gotenberg/v8 (Go) = 8.29.1, SEMVER:introduced=0; Gotenberg < 8.31.0, 8.29.1.
Is there a fix for CVE-2026-42589?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42589 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42589?
Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the /forms/pdfengines/metadata/write endpoint of Gotenberg. The application accepts a JSON metadata object and passes its keys to ExifTool via the go-exiftool library without validating for control characters. An attacker can embed a newline character (\n) in a JSON key, which causes the go-exiftool library to split the input into multiple argument lines when writing to ExifTool's stdin. This allows the injection of arbitrary ExifTool flags, such as '-if', which evaluates Perl expressions. By injecting a Perl 'system()' call, an unauthenticated remote attacker can achieve OS command execution. The attack is particularly stealthy as the server returns an HTTP 200 status and a valid PDF file even when the exploit is successful. The issue is resolved in version 8.31.0.

Affected products

  • Gotenberg Gotenberg < 8.31.0

Identifiers

  • CVE-2026-42589
  • GHSA-rqgh-gxv4-6657
  • GO-2026-5636

Timeline

  • 2026-04-30: advisory: GitHub Security Advisory published
  • 2026-05-14: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.