CVE-2026-40281: Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

Vulnerability summary

CVE-2026-40281 is a critical (CVSS 10.0) vulnerability in gotenberg. EPSS estimates a 2.26% chance of exploitation in the next 30 days, higher than 82.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-05-2026
   PublishedVulnerability first disclosed.
2. 07-05-2026
   Last modifiedVulnerability information updated.

Description

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.

• CWE-88Improper Neutralization of Argument Delimiters in a CommandThe product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.