CVE-2026-40281 in Gotenberg
Summary
by MITRE • 05/07/2026
Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/09/2026
The Gotenberg vulnerability represents a critical security flaw in the Docker-powered PDF processing API that affects versions 8.30.1 and earlier. This issue stems from an incomplete sanitization approach that addresses only metadata keys while neglecting metadata values, creating a persistent attack vector that bypasses the intended security measures. The vulnerability manifests through the metadata write endpoint where the system validates metadata keys for control characters but fails to sanitize the corresponding values, leaving a significant gap in the security posture.
The technical exploitation of this vulnerability relies on the specific behavior of ExifTool, which processes PDF metadata through stdin input streams. When a newline character is present in a metadata value, it causes the ExifTool stdin line to be split into two separate arguments, effectively enabling command injection. This injection mechanism allows attackers to introduce arbitrary ExifTool pseudo-tags including -FileName, -Directory, -SymLink, and -HardLink, which are powerful tools for manipulating file system operations. The flaw operates at the intersection of input validation and process execution, where insufficient sanitization of user-provided data leads to arbitrary command execution within the container environment.
The operational impact of this vulnerability extends beyond simple data manipulation to encompass complete file system compromise within the container. An unauthenticated attacker can leverage this vulnerability to rename or move any PDF file being processed to arbitrary paths within the container filesystem, effectively enabling unauthorized file system modifications. The ability to overwrite arbitrary files, create symbolic links, and establish hard links at arbitrary paths represents a severe privilege escalation opportunity that could lead to complete container compromise and potential lateral movement within the infrastructure. This vulnerability directly maps to CWE-77 and CWE-78 categories related to command injection and improper input sanitization, while also aligning with ATT&CK techniques for privilege escalation and persistence through file system manipulation.
The security implications of this vulnerability are particularly concerning given the stateless nature of Gotenberg and its containerized deployment model. The lack of authentication requirements for exploitation means that any external entity can potentially access and abuse this vulnerability, making it a high-severity threat to containerized environments. Organizations relying on Gotenberg for PDF processing and document management are at risk of unauthorized file system modifications, data exfiltration, and potential system compromise. The vulnerability demonstrates the importance of comprehensive input sanitization that addresses all aspects of user-provided data rather than implementing partial fixes that leave remaining attack vectors unaddressed. This flaw underscores the need for robust security practices including proper input validation, least privilege principles, and comprehensive testing of security controls to prevent such bypass scenarios from occurring in production environments.