10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40281

CVE-2026-40281: Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40281

CVE-2026-40281:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gotenberg/gotenberg/v8	go	<= 8.30.1	8.31.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the WriteMetadata function within pkg/modules/exiftool/exiftool.go. The root cause is improper input validation, specifically the failure to sanitize metadata values before passing them to the exiftool command-line utility. The vulnerability description explicitly points out that while metadata keys were sanitized, the values were not. An attacker could craft a metadata value with a newline character (\n) to inject arbitrary command-line arguments into the exiftool process. This could lead to arbitrary file operations on the server, such as moving, renaming, or creating symlinks, as demonstrated in the vulnerability report. The provided patch confirms this analysis by introducing a new function, validateMetadataValue, to sanitize these values by checking for control characters. This new validation is applied directly within the WriteMetadata function, confirming it as the location of the vulnerability.

Vulnerable functions

exiftool.ExifTool.WriteMetadata

pkg/modules/exiftool/exiftool.go

The `WriteMetadata` function is responsible for writing metadata to PDF files using the ExifTool command-line utility. Before the fix, this function did not sanitize the values of the metadata it received. An attacker could provide a metadata value containing a newline character. This value was then passed to the underlying `go-exiftool` library, which in turn writes it to the standard input of the `exiftool` process. The newline character was interpreted by `exiftool` as a delimiter for a new command-line argument, allowing an attacker to inject arbitrary arguments and execute malicious commands on the system, such as renaming or moving files.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.