Vendor

gotenberg

19 known vulnerabilities.

Products

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Critical 9.8

CVE-2026-42589 Public exploit

Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is perfor…

gotenberg gotenberg github.com/gotenberg/gotenberg/v7 github.com/gotenberg/gotenberg/v8 Go

May 14, 2026
Critical 10.0

CVE-2026-40281 Public exploit

Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the Ex…

gotenberg gotenberg github.com/gotenberg/gotenberg/v7 github.com/gotenberg/gotenberg/v8 Go

May 6, 2026