The vulnerability in Gotenberg allows an attacker to perform remote code execution by exploiting the lack of validation on JSON metadata keys sent to the /forms/pdfengines/metadata/write endpoint. By embedding a newline within a key, the payload is split into a new argument line for ExifTool, enabling malicious flags such as -if that execute arbitrary Perl expressions. This flaw can be triggered in a single HTTP request and results in a normal HTTP 200 response containing a PDF, making detection difficult. The CVSS score for this issue is 9.8 and the associated CWE is 78. The exploit does not require authentication.

Affected products include the Gotenberg containerized PDF API, with all versions prior to 8.31.0 vulnerable. The issue is specific to the /forms/pdfengines/metadata/write endpoint used by the go-exiftool library.

Given its high severity CVSS score and lack of existing mitigations, this flaw poses a critical risk to unprotected instances. The EPSS score is not available, but being unauthenticated, the attack can be attempted by anyone with network access. The vulnerability is not currently listed in the CISA KEV catalog, but its exploitation would likely generate false‑positive monitoring traffic due to the benign 200 response.