Arbitrary File Write Vulnerability in Gotenberg PDF Processing Tool

CVE-2026-44829

What is CVE-2026-44829?

Gotenberg is a Docker-powered API designed for handling PDF files. In versions prior to 8.33.0, a flaw in the filename handling process on Linux systems could allow a remote attacker to manipulate file paths. The vulnerability stems from the use of filepath.Base, which fails to recognize backslashes as path separators. This oversight can lead to an attacker crafting a malicious multipart filename with Windows-style parent directory components, enabling them to bypass sanitization measures. As a result, when these specially crafted filenames are processed, they can lead to arbitrary file writes on a downstream Windows system during the extraction of files from affected routes such as /forms/pdfengines/split or other multi-output PDF functionalities. This puts sensitive data at risk by allowing files to be extracted outside the intended directories. The issue has been addressed in version 8.33.0.

References