Gotenberg <= 8.30.1 - Remote Code Execution

Gotenberg through 8.30.1 sanitizes only the keys of the JSON metadata submitted to the PDF metadata write endpoint, leaving the values unvalidated. A newline inside a metadata value is written straight to the ExifTool process standard input, where it terminates the current argument and starts a n...

Exploit for Argument Injection in Thecodingmachine Gotenberg

CVE-2026-40281 A Working PoC For CVE-2026-40281 Gotenberg E...