CVE-2026-42589

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.31.0

Description Gotenberg is a Docker-powered stateless API for PDF files. The /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library without validating key characters. An attacker can embed a newline character ( ) in a JSON key to split the ExifTool stdin stream into a new argument line. This allows the injection of arbitrary ExifTool flags, such as -if, which evaluates Perl expressions, leading to unauthenticated OS command execution in a single HTTP request. The server responds with HTTP 200 and a valid PDF, making the attack transparent to basic monitoring. Real-world activity has been observed where an operator targeted 198 endpoints within 54 minutes.

Recommendations Update Gotenberg to version 8.31.0 or later. Place Gotenberg behind an authenticated reverse proxy to avoid exposing port 3000 directly to untrusted networks.