CVE-2026-42589: Gotenberg RCE via ExifTool Argument Injection

A critical vulnerability, CVE-2026-42589, has been identified in Gotenberg, a Docker-powered stateless API for PDF files. The National Vulnerability Database reports that versions prior to 8.31.0 are susceptible to unauthenticated OS command execution. The issue stems from the /forms/pdfengines/metadata/write HTTP endpoint, which directly passes JSON metadata keys to ExifTool via the go-exiftool library without proper validation.

Attackers can inject arbitrary ExifTool flags, including the -if flag for Perl expression evaluation, by embedding a newline character (\n) within a JSON key. This manipulation splits the ExifTool stdin stream, allowing for command injection. The National Vulnerability Database highlights that this can lead to unauthenticated OS command execution in a single HTTP request, with a standard HTTP 200 response and valid PDF, making detection challenging for basic monitoring.

With a CVSS score of 9.8 (Critical) and classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), this vulnerability presents a severe risk. Defenders must recognize that the attacker’s calculus here is straightforward: a single, unauthenticated HTTP request yields full system compromise. The stealthy nature of the attack response means organizations cannot rely on HTTP status codes to detect exploitation.