Code injection

In Gotenberg through 6.2.1, insecure permissions for tini writable by user gotenberg potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution...

Directory traversal

A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. This can lead to DoS, a change to program behavior, or code execution...

CVE-2020-13449

A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files...

CVE-2020-13449

CVE-2020-13449 affects Gotenberg's Markdown engine up to version 6.2.1, enabling directory traversal to read arbitrary container files. Root cause: directory traversal in the Markdown renderer. Impact: potential exposure of container files. Exploitation status: the PacketStorm entry indicates a c...

CVE-2020-13450

A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. This can lead to DoS, a change to program behavior, or code execution...

CVE-2020-13450

CVE-2020-13450 concerns Gotenberg, a Docker-powered stateless API for document conversion. The vulnerability is a directory traversal in the file upload function, affecting versions up to 6.2.1 (and earlier per sources). An attacker can upload and overwrite any writable files outside the intended...

CVE-2020-13451

An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros...

CVE-2020-13451

CVE-2020-13451 affects Gotenberg up to version 6.2.1. The issue is described as an incomplete-cleanup vulnerability in the Office rendering engine, enabling an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros. Connected documents corroborate the vulnerab...

CVE-2020-13452

Gotenberg <= 6.2.1 is affected by insecure permissions on tini (writable by the gotenberg user), enabling an attacker to overwrite files and potentially trigger denial of service or code execution. Vulnerability details are supported by multiple sources (e.g., Red Hat, CNVD, OSV, Veracode) and...

CVE-2020-13452

In Gotenberg through 6.2.1, insecure permissions for tini writable by user gotenberg potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution...

CVE-2020-13451: Incomplete Cleanup

An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros...

CVE-2020-13449: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files...

CVE-2020-13450: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. This can lead to DoS, a change to program behavior, or code execution...

CVE-2020-13452: Incorrect Default Permissions

In Gotenberg through 6.2.1, insecure permissions for tini writable by user gotenberg potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution...

Thecodingmachine Gotenberg 路径遍历漏洞

Gotenberg is a Docker-powered stateless API for converting HTML, Markdown and Office documents to PDF. A directory traversal vulnerability exists in the file upload functionality of Gotenberg 6.2.1 and earlier. An attacker could use this vulnerability to upload and overwrite arbitrary writable...

Thecodingmachine Gotenberg 路径遍历漏洞

Gotenberg is a Docker-powered stateless API for converting HTML, Markdown and Office documents to PDF. A directory traversal vulnerability exists in Gotenberg 6.2.1 and earlier versions of the Markdown engine. An attacker can exploit this vulnerability to read any container file...

Thecodingmachine Gotenberg 安全漏洞

Gotenberg is a Docker-powered stateless API for converting HTML, Markdown and Office documents to PDF. Gotenberg 6.2.1 and earlier versions are vulnerable. An attacker can exploit this vulnerability to overwrite LibreOffice configuration files and execute arbitrary code via macros...

Thecodingmachine Gotenberg 安全漏洞

Gotenberg is a Docker-powered stateless API for converting HTML, Markdown and Office documents to PDF. A file overwrite vulnerability exists in Gotenberg 6.2.1 and earlier versions. The vulnerability stems from insecure permissions in tini. An attacker can exploit the vulnerability to overwrite...

Gotenberg 6.2.0 Traversal / Code Execution / Insecure Permissions

1 Multiple vulnerabilities in Gotenberg │ │ │ │ My PDF │ │ │ │ Path: │ .DirPath │ PASSWD: │ toHTML .DirPath "../../../../etc/passwd" │ IP: │ toHTML .DirPath "../../../...