SCA: security update for github.com/gotenberg/gotenberg/v8 (GHSA-q7r4-hc83-hf2q)

critical Tenable Self-Hosted Container Security Plugin ID 441036

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata
write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A
newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing
injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This
is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can
rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite
arbitrary files, or create symlinks and hard links at arbitrary paths. (CVE-2026-40281)

Solution

Update the github.com/gotenberg/gotenberg/v8 library and its related packages to version 8.31.0 or later.

Plugin Details

Severity: Critical

ID: 441036

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 4/30/2026

Updated: 7/16/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7

Percentile: 98.3

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2026-40281

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/30/2026

Vulnerability Publication Date: 4/30/2026

Reference Information

CVE: CVE-2026-40281

cwe: CWE-88

Detections

Analytics