CVE-2020-13452 Privilege escalation in n/a
Insecure permissions on the tini binary in Gotenberg allow attackers to overwrite it, leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-13452?
CVE-2020-13452 is a critical vulnerability in n/a, published on 7 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution.
Weakness: CWE-276
Which versions are affected by CVE-2020-13452?
It affects 1 product.
Products include Thecodingmachine Gotenberg.
How do I fix CVE-2020-13452?
No fix has been published for CVE-2020-13452 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-13452 being exploited?
There is no known exploitation of CVE-2020-13452 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
- CVE-2026-42589 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
- CVE-2020-13450 Path traversal in n/a
- CVE-2020-13451 Code injection in n/a
- CVE-2026-42596 Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
Sources
Also known as GHSA-p869-hg26-w7c6.