Risk Letters

Exploited vulnerability

CVE-2026-40281

TLP:CLEAR

thecodingmachine gotenberg Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink,

Facts

  • Vendor: thecodingmachine
  • Product: Gotenberg is
  • CVSS: 10
  • EPSS (probability of exploitation within 30 days): 2.3 %
  • First known exploitation: 27 October 2026
  • First seen by Risk Letters: 6 May 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD