CVE-2026-40281criticalexploração observadaCWE-88

CVE-2026-40281: falha crítica em gotenberg

Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar gotenberg+ Monitorar github.com/gotenberg/gotenberg/v7

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

85Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 10epss 2.3%
da publicação à arma149 dias
Publicada no NVD6 de mai.
1ª PoC+149d
VulnCheck+174d
Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Produtos afetados
gotenberg · gotenberg
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — gotenberg

No mesmo produto, das mais perigosas para as menos.

CVE-2026-42589CRITICALGotenberg: Unauthenticated RCE via ExifTool Metadata Key InjectionEPSS 3.0%CVE-2026-40280HIGHGotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-listsEPSS 1.9%CVE-2026-27018HIGHGotenberg: Chromium deny-list bypass via case-insensitive URL schemeEPSS 1.7%CVE-2026-42596CRITICALGotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookEPSS 1.6%CVE-2026-55229HIGHGotenberg: SSRF via LibreOffice document processingEPSS 1.5%CVE-2026-45742HIGHGotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')EPSS 0.7%