CVE-2026-40281
CriticalPublic exploitGotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)
Published Apr 30, 2026 · Updated Aug 12, 2026 · Also known as GHSA-q7r4-hc83-hf2q, GO-2026-5572
Key Facts
Patch immediately- CVE-2026-40281 is a critical-severity vulnerability (CVSS 9.1 v3.1) affecting Gotenberg (Thecodingmachine), github.com/gotenberg/gotenberg/v7 (go), github.com/gotenberg/gotenberg/v8 (go).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 2.1% probability of exploitation in the next 30 days.
- Fixed versions are available, including github.com/gotenberg/gotenberg/v8 8.31.0, Gotenberg 8.31.0.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS (30-day exploit likelihood)
2.1%
Higher than 81.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-40281 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GotenbergThecodingmachine | >= <= 8.30.1 | 8.31.0 |
| github.com/gotenberg/gotenberg/v7go | See advisory | n/a |
| github.com/gotenberg/gotenberg/v8go | See advisory | 8.31.0 |
Patched Releases
github.com/gotenberg/gotenberg/v8
8.31.0
Gotenberg
8.31.0
Timeline
Publicly disclosed
Apr 30, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40281.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-40281
- articlehttps://github.com/gotenberg/gotenberg/commit/405f1069c026bb08f319fb5a44e5c67c33208318
- articlehttps://github.com/gotenberg/gotenberg/releases/tag/v8.31.0
FAQ
Common Questions.
Gotenberg is a Docker-powered stateless API for PDF files.
Affected: Gotenberg (Thecodingmachine) versions >= <= 8.30.1; github.com/gotenberg/gotenberg/v7 (go); github.com/gotenberg/gotenberg/v8 (go). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including github.com/gotenberg/gotenberg/v8 8.31.0, Gotenberg 8.31.0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-40281 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo