CVE-2026-40281criticalobserved exploitationCWE-88

CVE-2026-40281: critical vulnerability in gotenberg

Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

Published · Updated

Follow this CVE+ Monitor gotenberg+ Monitor github.com/gotenberg/gotenberg/v7

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 10epss 2.3%
from disclosure to weapon149 days
Published on NVDMay 6
1st PoC+149d
VulnCheck+174d
Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Affected products
gotenberg · gotenberg
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — gotenberg

In the same product, most dangerous first.

CVE-2026-42589CRITICALGotenberg: Unauthenticated RCE via ExifTool Metadata Key InjectionEPSS 3.0%CVE-2026-40280HIGHGotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-listsEPSS 1.9%CVE-2026-27018HIGHGotenberg: Chromium deny-list bypass via case-insensitive URL schemeEPSS 1.7%CVE-2026-42596CRITICALGotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookEPSS 1.6%CVE-2026-55229HIGHGotenberg: SSRF via LibreOffice document processingEPSS 1.5%CVE-2026-45742HIGHGotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')EPSS 0.7%