Gotenberg CVE-2026-40281

No special conditions - remote unauthenticated exploitation against default configurations of Gotenberg versions ≤8.30.1. Attack succeeds when the /forms/pdfengines/metadata/write endpoint is network-accessible, which is the default deployment mode for Gotenberg Docker containers listening on port 3000. CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms zero prerequisites: Network attack vector means exploitation from any network location, Low attack complexity means no timing windows or race conditions, None for Privileges Required confirms unauthenticated access, None for User Interaction means fully automated exploitation. The only deployment-specific limiting factor is network reachability - organizations running Gotenberg behind authentication gateways, VPNs, or internal-only network segments reduce exposure to authorized users or compromised internal systems. Default Docker containers run as root (UID 0), amplifying filesystem manipulation impact; running with --user flag to drop privileges limits but does not eliminate risk, as symlink creation and temp directory manipulation remain viable. The vulnerability works identically whether Gotenberg is deployed standalone, in Kubernetes, or via docker-compose, as the attack targets the application logic rather than container orchestration. Changed scope (S:C) in CVSS vector indicates potential to escape resource boundaries, relevant for multi-tenant environments where Gotenberg processes untrusted documents.

CVSS 10.0 (Critical) accurately reflects the technical severity: network-accessible (AV:N), trivial to exploit with no authentication (PR:N/AC:L), no user interaction (UI:N), and scope change (S:C) indicating potential container breakout. However, real-world risk depends heavily on deployment context. The attack requires the Gotenberg metadata write endpoint to be network-accessible, which may not be the case in architectures where Gotenberg runs as an internal microservice behind authentication layers. EPSS data not provided, but the detailed reproduction steps in the GitHub advisory (GHSA-q7r4-hc83-hf2q) effectively serve as a public proof-of-concept, lowering the bar for weaponization. No CISA KEV listing indicates no confirmed active exploitation as of analysis date, suggesting this is a newly disclosed vulnerability (CVE-2026 suggests future assignment or typo; verify actual CVE ID). SSVC decision factors: Exploitation Status = POC (public reproduction exists), Automatable = YES (HTTP API exploitation requires no human interaction), Technical Impact = TOTAL (arbitrary file write as root enables full container compromise). Primary risk: organizations exposing Gotenberg directly to untrusted networks without authentication face immediate RCE risk. Secondary risk: even internal deployments face lateral movement scenarios if other services can reach the endpoint. The vulnerability being a bypass of a previous incomplete fix (v8.30.1) suggests the development team underestimated the attack surface - defenders should verify the completeness of the v8.31.0 fix before deploying. Key conflict requiring verification: CVE ID CVE-2026-40281 appears anachronistic (2026 prefix) - confirm this is not a placeholder or reporting error, as it affects tracking in vulnerability databases.

An attacker crafts an HTTP POST request to the Gotenberg /forms/pdfengines/metadata/write endpoint containing a PDF file and a metadata JSON payload with Title value set to 'benign\n-FileName=/etc/cron.d/backdoor'. The embedded newline splits the ExifTool stdin into two arguments: the first sets Title normally, the second moves the uploaded PDF to /etc/cron.d/backdoor, creating a persistent cron job that executes every minute with root privileges inside the container. From there, the attacker establishes command-and-control by embedding reverse shell commands in the cron job, achieving full container compromise. Alternatively, using -SymLink=/app/config.json creates a symlink that future API calls can leverage to read sensitive configuration files. Public proof-of-concept exists in GitHub advisory GHSA-q7r4-hc83-hf2q with full Docker reproduction steps.