CVE-2026-40893

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/gotenberg/gotenberg/security/advisories/GHSA-62p3-hvxx-fxg4	Exploit Vendor Advisory
https://github.com/gotenberg/gotenberg/security/advisories/GHSA-62p3-hvxx-fxg4	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-14 16:16

Updated : 2026-06-17 10:45

NVD link : CVE-2026-40893

Mitre link : CVE-2026-40893

CVE.ORG link : CVE-2026-40893

JSON object : View

Products Affected

thecodingmachine

gotenberg

CWE

CWE-73

External Control of File Name or Path

CWE-184

Incomplete List of Disallowed Inputs

{"id": "CVE-2026-40893", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40893", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T18:08:23.445431Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gotenberg", "product": "gotenberg", "versions": [{"status": "affected", "version": "< 8.31.0"}]}]}], "published": "2026-05-14T16:16:20.323", "references": [{"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-62p3-hvxx-fxg4", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-62p3-hvxx-fxg4", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-184"}]}], "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0."}], "lastModified": "2026-06-17T10:45:50.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "953D4808-E728-472B-94E3-9714C1E2EA1C", "versionEndExcluding": "8.31.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}