Unvalidated Input Vulnerability in Gotenberg PDF Processing API

CVE-2026-42589

What is CVE-2026-42589?

CVE-2026-42589 is a significant vulnerability affecting Gotenberg, a Docker-powered API designed for processing PDF files. The flaw exists in the API's handling of JSON metadata input at the /forms/pdfengines/metadata/write HTTP endpoint, where it directly interacts with ExifTool without validating the input. This lack of validation allows for the manipulation of key characters in the JSON metadata, specifically enabling attackers to inject arbitrary ExifTool commands. This can result in unauthenticated operating system command execution with a single HTTP request, leading to serious security implications for organizations using the Gotenberg API. The challenge is compounded by the fact that successful exploitation can yield an HTTP 200 response containing a valid PDF, which may go undetected by basic monitoring systems.

Potential Impact of CVE-2026-42589

1. Unauthorized Command Execution: Attackers can exploit this vulnerability to execute arbitrary commands on the host operating system. This capability allows for a broad range of malicious activities, including the installation of malware or the alteration of system configurations.

2. Data Breach Risks: Given that the vulnerability can be exploited to gain unauthorized access, it poses a risk of exposing sensitive data stored on systems that rely on Gotenberg for PDF processing. This could lead to significant data loss and legal implications for affected organizations.

3. Persistence of Malicious Activities: Since the exploitation can be conducted without authentication and returns a legitimate-looking PDF, there is a risk that attackers could establish persistence within a compromised environment, facilitating further malicious operations and potentially leading to more extensive breaches, including ransomware deployments.

References