Injection Vulnerability in Gotenberg PDF Processing API

CVE-2026-40281

What is CVE-2026-40281?

The Gotenberg PDF API, a Docker-based tool for PDF file processing, has a significant vulnerability affecting versions 8.30.1 and earlier. It allows unauthenticated attackers to exploit the metadata write endpoint, which inadequately sanitizes metadata values. By including a newline character in a metadata value, an attacker can inject arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This exploitation can lead to unauthorized actions such as renaming or moving PDF files to arbitrary paths in the container's filesystem. Additionally, attackers may overwrite files or create symbolic and hard links at will, posing a major security risk to the system's integrity.

References