CVE-2026-44829 Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename
Remote attackers can write arbitrary files on downstream Windows systems via path traversal in zip entry names when extracting archives generated by Gotenberg.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44829?
CVE-2026-44829 is a high-severity path traversal vulnerability in gotenberg, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\Windows\System32\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-44829?
4 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v8 and github.com/gotenberg/gotenberg/v7.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.33.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.33.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.33.0 |
github.com/gotenberg/gotenberg/v7 Go | All versions | None |
How do I fix CVE-2026-44829?
Upgrade github.com/gotenberg/gotenberg/v8 to 8.33.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44829 being exploited?
There is no known exploitation of CVE-2026-44829 in the wild and no public exploit code.
Sources
Also known as GHSA-hwc4-gmrw-5222, GO-2026-5443.