Security researchers have reported active exploitation of a flaw in Gotenberg, the open-source service that converts documents to PDF files, and the activity was highlighted again in a threat bulletin dated 29 October 2026. The flaw, tracked as CVE-2026-42589, is rated CVSS 9.8 and was fixed in Gotenberg 8.31.0. Operators running older versions, especially on internet-facing systems, should treat the update as urgent.

Gotenberg is a Docker-based API that turns HTML, web addresses and office documents into PDFs. That makes it a common building block for invoices and reports, and means an attacker who can reach its API may be able to reach the container running it.

How the flaw works

The flaw sits in the endpoint used to write PDF metadata. That endpoint accepts a PDF file and a JSON metadata object, and passes the metadata keys to ExifTool, a tool for reading and writing file metadata. The vulnerability record states that no validation was performed on key characters, so a newline character embedded in a JSON key could split the stream of arguments sent to ExifTool and inject a new argument. One injected argument can evaluate Perl expressions, which in turn allows operating-system command execution. Because the server still returns a valid PDF, the attack can leave little obvious sign in basic monitoring.

What exploitation has looked like

VulnCheck reports 1,358 exploitation events from 128 source addresses over 30 days, and describes a case in early October in which an attacker used the flaw to deploy a custom Go reverse shell, referred to as cache_base. Observed activity has also included commodity scanning and cryptomining. The advice is straightforward: upgrade to 8.31.0 or later, do not leave an unpatched instance exposed to the internet, and review logs for unexpected downloads or outbound connections.

Sources: VulnCheck, Cache Me If You Can; Threadlinqs summary of The Hacker News ThreatsDay bulletin, 29 October 2026.