CVE-2026-44829

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44829", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T21:21:48.351Z", "datePublished": "2026-08-19T14:35:06.966Z", "dateUpdated": "2026-08-19T18:19:27.164Z"}, "containers": {"cna": {"title": "Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222"}, {"name": "https://github.com/gotenberg/gotenberg/issues/662", "tags": ["x_refsource_MISC"], "url": "https://github.com/gotenberg/gotenberg/issues/662"}, {"name": "https://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3", "tags": ["x_refsource_MISC"], "url": "https://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3"}, {"name": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0"}], "affected": [{"vendor": "gotenberg", "product": "gotenberg", "versions": [{"version": "< 8.33.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T14:35:06.966Z"}, "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\\Windows\\System32\\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0."}], "source": {"advisory": "GHSA-hwc4-gmrw-5222", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T18:03:43.071414Z", "id": "CVE-2026-44829", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:19:27.164Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44829", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T18:03:43.071414Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:03:44.171Z"}}], "cna": {"title": "Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename", "source": {"advisory": "GHSA-hwc4-gmrw-5222", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "gotenberg", "product": "gotenberg", "versions": [{"status": "affected", "version": "< 8.33.0"}]}], "references": [{"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222", "name": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gotenberg/gotenberg/issues/662", "name": "https://github.com/gotenberg/gotenberg/issues/662", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3", "name": "https://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0", "name": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\\Windows\\System32\\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T14:35:06.966Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44829", "state": "PUBLISHED", "dateUpdated": "2026-08-19T18:19:27.164Z", "dateReserved": "2026-05-07T21:21:48.351Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T14:35:06.966Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gotenberg", "vendor": "gotenberg", "versions": [{"status": "affected", "version": "< 8.33.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\\Windows\\System32\\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0."}, {"lang": "es", "value": "Gotenberg es una API sin estado impulsada por Docker para archivos PDF. En la versi\u00f3n 8.32.0 y anteriores, el manejo de nombres de archivo en pkg/modules/api/context.go utiliza filepath.Base en Linux, que no trata las barras invertidas como separadores de ruta, por lo que un nombre de archivo multipart que contiene componentes de directorio padre estilo Windows sobrevive a la sanitizaci\u00f3n. El nombre de archivo original fluye a trav\u00e9s de ctx.diskToOriginal y las rutas PDF de salida m\u00faltiple hacia archives.FilesFromDisk y archives.Zip.Archive como el nombre de entrada zip generado. Un atacante remoto puede enviar un nombre como .... / Windows\\System32\\evil.pdf a trav\u00e9s de una carga o un encabezado Content-Disposition de descarga ascendente, y un extractor de archivos de Windows puede escribir el archivo resultante fuera del directorio de extracci\u00f3n previsto. Las rutas afectadas incluyen /forms/pdfengines/split y otras rutas de PDF de salida m\u00faltiple, LibreOffice y conversi\u00f3n, y la explotaci\u00f3n puede causar escrituras de archivos arbitrarias en un sistema Windows descendente cuando un usuario o proceso extrae el archivo devuelto. Este problema est\u00e1 solucionado en la versi\u00f3n 8.33.0."}], "id": "CVE-2026-44829", "lastModified": "2026-10-27T13:10:00.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44829", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T18:03:43.071414Z", "version": "2.0.3"}}]}, "published": "2026-08-19T15:17:02.630", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3"}, {"source": "security-advisories@github.com", "url": "https://github.com/gotenberg/gotenberg/issues/662"}, {"source": "security-advisories@github.com", "url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.33.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gotenberg", "source": "cna", "vendor": "gotenberg"}, "product": "gotenberg", "vendor": "gotenberg"}], "created": "2026-08-19T16:00:04.406043+00:00", "updated": "2026-08-20T16:30:04.581652+00:00", "vendors": ["gotenberg", "gotenberg$PRODUCT$gotenberg"]}