CVE-2026-42593 Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes
An attacker can read arbitrary PDF files from the server filesystem by manipulating stamp and watermark expressions in Gotenberg PDF conversion routes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42593?
CVE-2026-42593 is a medium-severity path traversal vulnerability in gotenberg, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfengines/split, libreoffice/convert, chromium/convert/url, chromium/convert/html, and chromium/convert/markdown accept stampSource=pdf + stampExpression=/path and watermarkSource=pdf + watermarkExpression=/path from anonymous callers. The dedicated stamp/watermark routes require an uploaded file when the source type is image or pdf; these six routes only overwrite the expression when a file is uploaded, leaving the user-controlled path intact when no file is attached. pdfcpu opens the path and composites its pages onto the output PDF, which returns to the caller. An attacker reads any PDF the Gotenberg process can access on the container filesystem. This vulnerability is fixed in 8.32.0.
Which versions are affected by CVE-2026-42593?
4 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v8 and github.com/gotenberg/gotenberg/v7. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gotenberg/gotenberg/v8 Go | All versions | None |
github.com/gotenberg/gotenberg/v8 Go | All versions to 8.31.0 | None |
github.com/gotenberg/gotenberg/v8 Go | All versions to 8.31.0 | None |
github.com/gotenberg/gotenberg/v7 Go | All versions | None |
Products include Thecodingmachine Gotenberg.
How do I fix CVE-2026-42593?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-42593 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42593 exists.
Other vulnerabilities in gotenberg
Sources
Also known as GHSA-3cv5-q585-h563, GO-2026-5080.