Exploit for Argument Injection in Thecodingmachine Gotenberg

🔥 GOTENBERG RCE CHAIN CVE-2026-42589 + CVE-2026-40281 !...

VulnCheck KEV: CVE-2026-42589

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded i...