Executive brief
Gotenberg is a tool used to convert various documents into PDF files via a web interface. A security flaw allows an unauthenticated attacker to execute malicious commands on the server by sending a specially crafted request to the metadata editing feature. This could lead to a total system takeover, data theft, or a foothold for further attacks within a corporate network, all while appearing as a successful, normal document process to monitoring tools.
Technical details
The vulnerability exists in the /forms/pdfengines/metadata/write endpoint of Gotenberg. The application accepts a JSON metadata object and passes its keys to ExifTool via the go-exiftool library without validating for control characters. An attacker can embed a newline character (\n) in a JSON key, which causes the go-exiftool library to split the input into multiple argument lines when writing to ExifTool's stdin. This allows the injection of arbitrary ExifTool flags, such as '-if', which evaluates Perl expressions. By injecting a Perl 'system()' call, an unauthenticated remote attacker can achieve OS command execution. The attack is particularly stealthy as the server returns an HTTP 200 status and a valid PDF file even when the exploit is successful. The issue is resolved in version 8.31.0.
Affected products
- Gotenberg Gotenberg < 8.31.0
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD