CVE-2026-40281 - Vulnerability Analysis
CriticalCVSS: 10.0Last Updated: May 6, 2026
Gotenberg - Command Injection
Published: May 6, 2026Updated: May 6, 2026Remote Exploitable
Overview
Gotenberg <= 8.30.1 contains a command injection caused by unsanitized newline characters in metadata values in the metadata write endpoint, letting unauthenticated attackers rename, move, or overwrite files via ExifTool pseudo-tags.
Severity & Score
Severity: Critical
CVSS Score: 10.0
Impact
Unauthenticated attackers can rename, move, overwrite files, or create symlinks/hardlinks in the container filesystem, leading to arbitrary file manipulation.
Mitigation
Update to a version later than 8.30.1 or the latest available version.
References
Related Resources
Details
- CVE ID
- CVE-2026-40281
- Severity
- Critical
- CVSS Score
- 10.0
- Type
- command_injection
- Status
- new
CWE
- CWE-88
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H