CVE-2026-40281

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.31.0

Description Gotenberg is a Docker-powered stateless API for PDF files. The metadata write endpoint validates metadata keys for control characters but fails to sanitize metadata values. A newline character ( ) injected into a metadata value splits the ExifTool stdin line into two separate arguments, allowing the injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This issue is a bypass of a previous incomplete fix that only validated keys.

An unauthenticated attacker can exploit this via the /forms/pdfengines/metadata/write endpoint by manipulating the metadata parameter. This can lead to remote code execution, allowing the attacker to rename or move PDFs to arbitrary paths in the container filesystem, overwrite critical system files, or create symlinks and hard links. The vulnerability is triggered within the WriteMetadata() function in pkg/modules/exiftool/exiftool.go when passing values to the SetString() function of the go-exiftool library.

Recommendations Update Gotenberg to version 8.31.0 or later. As a temporary mitigation, restrict access to the /forms/pdfengines/metadata/write endpoint.