Description

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\Windows\System32\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T15:17:02.630Z",
  "pubdate": "2026-08-19T15:17:02.630Z",
  "executiveSummary": "Gotenberg versions 8.32.0 and earlier contain a path traversal vulnerability residing in filename handling logic, specifically within multi-output PDF, LibreOffice, and conversion routes.\nThe vulnerability allows a remote attacker to supply a crafted multipart filename containing Windows-style directory traversal sequences.\nThe impact of successful exploitation includes arbitrary file write execution on a downstream Windows system when a user or automated process extracts the resulting archive generated by Gotenberg.\nAttackers can leverage this vulnerability by submitting malicious filenames either directly through file uploads or via upstream downloadFrom Content-Disposition headers.\nThe risk implications are severe for environments where Gotenberg outputs are subsequently processed and extracted on Windows-based infrastructure.\nNo specific authentication or advanced privileges are required by the attacker to submit the payload, relying instead on the improper neutralization of path separators during filename sanitization on Linux-based execution environments.",
  "technicalDetails": "The root cause of the vulnerability lies in pkg/modules/api/context.go, where filename handling utilizes the Go standard library function filepath.Base on Linux.\nBecause filepath.Base on Linux does not recognize backslashes as path separators, filenames containing Windows-style parent directory components (such as backslashes and dot-dot sequences) survive the sanitization process.\nThe unsanitized original filename subsequently flows through ctx.diskToOriginal and enters multi-output PDF routes, eventually reaching archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name.\nAn attacker initiates the attack flow by submitting a malicious payload, such as '........\\Windows\\System32\\evil.pdf', via a file upload mechanism or through an upstream downloadFrom Content-Disposition header.\nGotenberg processes the request through affected paths including /forms/pdfengines/split and other multi-output conversion routes, packaging the resulting files into an archive.\nWhen a downstream user or process on a Windows system extracts the malicious archive, the traversal sequences in the zip entry name are interpreted by Windows archive extractors, allowing files to be written outside the intended extraction directory.\nThe vulnerable component is the filename sanitization and archiving pipeline within Gotenberg 8.32.0 and earlier running in Linux Docker containers.\nNetwork exposure is present wherever the Gotenberg API is accessible to untrusted clients for document conversion tasks."
}