CVE-2026-42589

What it is

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded in a JSON key splits the ExifTool stdin stream into a new argument line, allowing an attacker to inject arbitrary ExifTool flags — including -if, which evaluates Perl expressions. This achieves unauthenticated OS command execution in a single HTTP request. The response is HTTP 200 with a valid PDF, making the attack transparent to basic monitoring. This vulnerability is fixed in 8.31.0.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.

Exploit odds

3.0% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-05-14 16:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 10:48 UTC Last updatedMost recent change to the record

Details

Published

2026-05-14 16:16 UTC

Last modified

2026-06-17 10:48 UTC

Exploit probability

3.0% · EPSS, next 30 days

Weakness

CWE-78 · OS command injection

Record status

Analyzed

Affected

• Thecodingmachine Gotenberg < 8.31.0

Attack profile CVSS 3.1 · 9.8

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High