← Vulnerability feed

Vulnerability record · CVE-2026-42593 · published 14 May 2026

CVE-2026-42593: Thecodingmachine gotenberg path traversal vulnerability

Thecodingmachine · Gotenberg

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfengines/split, libreoffice/convert, chromium/convert/url, chromium/convert/html, and chromium/convert/markdown accept stampSource=pdf + stampExpression=/path and watermarkSource=pdf + watermarkExpression=/path from anonymous callers. The dedicated stamp/watermark routes require an uploaded file when the source type is image or pdf; these six routes only overwrite the expression when a file is uploaded, leaving the user-controlled path intact when no file is attached. pdfcpu opens the path and composites its pages onto the output PDF, which returns to the caller. An attacker reads any PDF the Gotenberg process can access on the container filesystem. This vulnerability is fixed in 8.32.0.

5.3 CVSS 3.1 Medium EPSS 0.40% · top 68.3% CWE-22 · Path traversalCWE-73 · CWE-73
5.3CVSS 3.1 base score
0.40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfengines/split, libreoffice/convert, chromium/convert/url, chromium/convert/html, and chromium/convert/markdown accept stampSource=pdf + stampExpression=/path and watermarkSource=pdf + watermarkExpression=/path from anonymous callers. The dedicated stamp/watermark routes require an uploaded file when the source type is image or pdf; these six routes only overwrite the expression when a file is uploaded, leaving the user-controlled path intact when no file is attached. pdfcpu opens the path and composites its pages onto the output PDF, which returns to the caller. An attacker reads any PDF the Gotenberg process can access on the container filesystem. This vulnerability is fixed in 8.32.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/gotenberg/gotenberg/security/advisories/GHSA-3cv5-q585-h563 ExploitMitigationVendor Advisory
https://github.com/gotenberg/gotenberg/security/advisories/GHSA-3cv5-q585-h563 ExploitMitigationVendor Advisory

Track CVE-2026-42593 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-42589Thecodingmachine gotenberg os command injection vulnerabilityGotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON…EPSS 3.7%9.8CVE-2020-13452Thecodingmachine gotenberg incorrect default permissions vulnerabilityIn Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can…EPSS 2.7%9.8CVE-2020-13450Thecodingmachine gotenberg path traversal vulnerabilityA directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files …EPSS 5.6%9.8CVE-2020-13451Thecodingmachine gotenberg vulnerabilityAn incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configurati…EPSS 3.0%9.4CVE-2026-42596Thecodingmachine gotenberg server-side request forgery (ssrf) vulnerabilityGotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webho…EPSS 1.8%9.1CVE-2026-40281Thecodingmachine gotenberg argument injection vulnerabilityGotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for co…EPSS 0.66%8.7CVE-2026-35458Thecodingmachine gotenberg inefficient regular expression (redos) vulnerabilityGotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns wi…EPSS 0.61%8.6CVE-2026-42595Thecodingmachine gotenberg server-side request forgery (ssrf) vulnerabilityGotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/forms/chromium/convert/url) ha…EPSS 0.42%

Source: NIST National Vulnerability Database (record CVE-2026-42593), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.