SB2026050503 - Multiple vulnerabilities in gotenberg

Description

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-40280)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to trigger server-side request forgery.

The vulnerability exists due to improper input validation in webhook and downloadFrom deny-list protection when processing case-insensitive URL schemes. A remote attacker can supply a specially crafted URL to trigger server-side request forgery.

2) Command injection (CVE-ID: CVE-2026-40281)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary commands and cause a denial of service.

The vulnerability exists due to improper neutralization of special elements in ExifTool argument handling in gotenberg when processing metadata values containing newline characters from user-supplied input. A remote attacker can supply a specially crafted metadata value to execute arbitrary commands and cause a denial of service.

The issue is a bypass of the key sanitization logic for stdin arguments via metadata value newlines.

Remediation

Install update from vendor's website.

References

• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5q7p-7jgv-ww56
• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q