Is CVE-2026-42590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42590 being exploited in the wild.

How severe is CVE-2026-42590?

High severity, with a CVSS score of 8.2, published 14 May 2026.

Which products and versions are affected?

github.com/gotenberg/gotenberg/v7 (Go) SEMVER:introduced=0; github.com/gotenberg/gotenberg/v8 (Go) <= 8.29.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=8.29.1; Gotenberg < 8.30.0, <= 8.29.1.

Is there a fix for CVE-2026-42590?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42590 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42590?

Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42590: Gotenberg ExifTool blocklist bypass via group-prefix syntax

Q: Is there a fix for CVE-2026-42590?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-42590 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42590?

Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42590 · Severity: high · CVSS 8.2 · Published 2026-05-14

Gotenberg is a tool used to convert various document formats into PDF files via a web API. A security flaw allows attackers to bypass safety restrictions and manipulate files on the server, including renaming, moving, or creating links to files. This could lead to unauthorized file access or service disruption, especially in environments where the tool has access to shared storage or sensitive directories.

Technologies: github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go), Gotenberg. Vendors: Go, Gotenberg.

Quick answers

Is CVE-2026-42590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42590 being exploited in the wild.
How severe is CVE-2026-42590?: High severity, with a CVSS score of 8.2, published 14 May 2026.
Which products and versions are affected?: github.com/gotenberg/gotenberg/v7 (Go) SEMVER:introduced=0; github.com/gotenberg/gotenberg/v8 (Go) <= 8.29.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=8.29.1; Gotenberg < 8.30.0, <= 8.29.1.
Is there a fix for CVE-2026-42590?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42590 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42590?: Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ExifTool metadata write blocklist in Gotenberg v8 can be bypassed using ExifTool's group-prefix syntax (e.g., 'File:FileName' instead of 'FileName'). The application's validation logic uses a regex that permits colons, allowing prefixed tags to pass through to ExifTool, which then strips the prefix and executes the restricted command. This enables an unauthenticated remote attacker to rename, move, or create symlinks/hardlinks for files within the container. Additionally, certain pseudo-tags like FilePermissions, FileUserID, and FileGroupID were not included in the blocklist at all, allowing modification of file attributes. The vulnerability is a bypass of a previous fix (GHSA-qmwh-9m9c-h36m) and is resolved in version 8.30.0.

Affected products

Gotenberg Gotenberg < 8.30.0

Identifiers

CVE-2026-42590
GHSA-7v3r-m9c8-r855
GO-2026-5234

Timeline

2026-04-30: advisory: GitHub security advisory published
2026-05-14: disclosed: CVE published to NVD

References

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-7v3r-m9c8-r855

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.