Gotenberg’s metadata write endpoint validates keys but does not sanitize values. A newline character in a metadata value causes ExifTool to receive a second argument, allowing an attacker to inject pseudo-tags that can rename, move, overwrite, or link files inside the container. The result is a privilege escalation within the container’s filesystem that can compromise the integrity of all PDFs processed by the service.

The gotenberg:gotenberg product, all releases up to and including version 8.30.1, is affected. Versions newer than 8.30.1 incorporate the key‑sanitization fix and are not vulnerable.

With a CVSS score of 10, this flaw is rated critical. No EPSS score is available, and the vulnerability is not listed in CISA KEV, but the lack of authentication and the ability to modify arbitrary files make exploitation highly attractive to attackers. An attacker can craft a malicious PDF that contains a newline in a metadata value, send it to the public API, and immediately place, rename, or overwrite files in the container.