CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
An unauthenticated attacker can inject arguments into ExifTool via newlines in metadata values, allowing arbitrary file manipulation or code execution within the container.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40281?
CVE-2026-40281 is a critical command injection vulnerability in gotenberg, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.
Weakness: CWE-88
Which versions are affected by CVE-2026-40281?
4 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v8 and github.com/gotenberg/gotenberg/v7. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.31.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.31.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.31.0 |
github.com/gotenberg/gotenberg/v7 Go | All versions | None |
Products include Thecodingmachine Gotenberg.
How do I fix CVE-2026-40281?
Upgrade github.com/gotenberg/gotenberg/v8 to 8.31.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-40281 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40281 exists.
Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in gotenberg
- CVE-2026-42589 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
- CVE-2020-13450 Path traversal in n/a
- CVE-2020-13451 Code injection in n/a
- CVE-2020-13452 Privilege escalation in n/a
- CVE-2026-42596 Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
Sources
Also known as GHSA-q7r4-hc83-hf2q, GO-2026-5572.