CVE-2026-40281: fallo crítico en gotenberg
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
85Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 10epss 2.3%
de la publicación al arma149 días
Publicada en NVD6 may
1ª PoC+149d
VulnCheck+174d
Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Productos afectados
gotenberg · gotenbergPoCs públicas encontradas — 4
vulncheckvulncheck.com/xdb/22443535b87cno verificadovulncheckvulncheck.com/xdb/f652d079d95eno verificadovulncheckvulncheck.com/xdb/c2abda692007no verificadovulncheckvulncheck.com/xdb/4a60b1af7d8dno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — gotenberg
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-42589CRITICALGotenberg: Unauthenticated RCE via ExifTool Metadata Key InjectionEPSS 3.0%CVE-2026-40280HIGHGotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-listsEPSS 1.9%CVE-2026-27018HIGHGotenberg: Chromium deny-list bypass via case-insensitive URL schemeEPSS 1.7%CVE-2026-42596CRITICALGotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookEPSS 1.6%CVE-2026-55229HIGHGotenberg: SSRF via LibreOffice document processingEPSS 1.5%CVE-2026-45742HIGHGotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')EPSS 0.7%