The vulnerability permits any anonymous caller to provide arbitrary file paths in stampExpression and watermarkExpression parameters of the merge, split, convert routes. PDF engine pdfcpu reads the specified PDF and composites it into the returned document, allowing the attacker to obtain the contents of any PDF that the Gotenberg process can access. This is a classic arbitrary file read, providing information disclosure. The weakness involves path traversal and ambiguous file type handling (CWE-22, CWE-73). The impact is limited to reading existing files; there is no remote code execution or privilege escalation.

All Gotenberg installations running a version older than 8.32.0 are affected. The vendor’s product list indicates gotenberg:gotenberg. No specific version numbers are listed beyond the release that fixed the issue. Therefore any deployment using Gotenberg prior to the 8.32.0 release is vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue. Attackers can exploit it by making the vulnerable API calls over the network; authentication is not required. The path information supplied by the caller is used directly without validation, so the attack requires no additional privileges. Consequently, the risk is primarily limited to potentially exposing sensitive PDF documents on the container file system if the container is not isolated.