CVE-2026-44829
Received Received - Intake

Path Traversal in Gotenberg PDF API

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\Windows\System32\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-44829
EUVD
EUVD-2026-62427

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gotenberg gotenberg to 8.33.0 (exc)
gotenberg gotenberg 8.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44829 is a path traversal vulnerability in Gotenberg versions 8.32.0 and earlier. It occurs when a malicious filename containing Windows-style backslashes is processed through multi-output routes that return results as a ZIP file. The vulnerability allows an attacker to write arbitrary files outside the intended extraction directory on a Windows system by exploiting how the software handles filenames during ZIP creation.

Detection Guidance

Check if your Gotenberg version is 8.32.0 or earlier. Inspect network traffic for uploads or downloads involving ZIP files with filenames containing backslashes or path traversal sequences like ..\. Use tools like Wireshark to monitor for suspicious filenames in HTTP requests or responses.

Impact Analysis

This vulnerability can allow a remote attacker to write arbitrary files on a downstream Windows system when a user or process extracts a ZIP file generated by Gotenberg. This could lead to system compromise, data corruption, or unauthorized file access if the attacker crafts a malicious filename that targets sensitive system directories like Windows\System32.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling arbitrary file writes on Windows systems. If exploited, it may allow unauthorized access to sensitive files or data, compromising confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Gotenberg to version 8.33.0 or later. If upgrading is not immediately possible, implement input validation to reject filenames containing backslashes or path traversal sequences. Monitor for unusual file writes on Windows systems, especially in system directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44829. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart