PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42589 gotenberg CVE debrief

Gotenberg versions prior to 8.31.0 contain a critical unauthenticated command injection vulnerability in the /forms/pdfengines/metadata/write endpoint. The flaw arises from insufficient validation of JSON metadata keys, which are passed directly to ExifTool via the go-exiftool library. An attacker can embed newline characters in JSON keys to split the ExifTool stdin stream, injecting arbitrary flags including -if for Perl expression evaluation. This enables OS command execution through a single HTTP request. The attack is stealthy: the endpoint returns HTTP 200 with a valid PDF, evading basic monitoring. The vulnerability was published on 2026-05-14 and last modified on 2026-05-18. No known exploitation in ransomware campaigns has been reported.

Vendor
gotenberg
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-18
Advisory published
2026-05-14
Advisory updated
2026-05-18

Who should care

Organizations running Gotenberg PDF conversion services, particularly those exposed to untrusted network traffic or processing user-supplied documents. DevOps teams managing containerized document processing pipelines. Security operations centers monitoring for API abuse in document conversion workflows.

Technical summary

The vulnerability exists in Gotenberg's metadata writing functionality, which uses ExifTool for PDF metadata manipulation. The go-exiftool library passes JSON metadata keys directly to ExifTool's stdin without sanitization. By crafting a JSON key containing a newline character followed by ExifTool flags, an attacker can escape the intended argument context and inject arbitrary command-line options. The -if flag is particularly dangerous as it evaluates Perl expressions, enabling arbitrary code execution. The vulnerability is network-accessible, requires no authentication, and produces no visible error conditions, making it suitable for automated exploitation.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Gotenberg to version 8.31.0 or later immediately
  • If immediate patching is not possible, restrict network access to the Gotenberg service to trusted hosts only
  • Monitor for anomalous HTTP requests to /forms/pdfengines/metadata/write containing newline characters in JSON keys
  • Review application logs for unexpected process execution or outbound connections from Gotenberg containers
  • Implement Web Application Firewall rules to detect and block requests with suspicious metadata key patterns

Evidence notes

Vendor advisory confirms exploitation via crafted JSON metadata with embedded newlines to inject ExifTool flags. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H supports critical severity. CPE range confirms all versions below 8.31.0 are vulnerable.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42589 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42589

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42589 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42589

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.