Arbitrary File Manipulation Vulnerability in Gotenberg Docker API
CVE-2026-42590

8.2HIGH

Key Information:

Vendor

Gotenberg

Status
Gotenberg
Vendor
CVE Published:
14 May 2026

What is CVE-2026-42590?

The Gotenberg API, a Docker-powered stateless service for PDF file processing, has a vulnerability that allows attackers to bypass the ExifTool metadata write blocklist. This can be exploited using ExifTool's group-prefix syntax, enabling unauthorized file renaming, moving, and symlink creation on the server. The regex employed in this context fails to block certain prefixes, leading to potential security breaches. Key attributes such as FilePermissions, FileUserID, and FileGroupID can be altered without restriction. The issue was resolved in version 8.30.0.

Affected Version(s)

gotenberg < 8.30.0

References

https://github.com/gotenberg/gotenberg/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.