{"id":"EUVD-2026-62427","enisaUuid":"6f5dc22b-57ad-32ab-a7e5-0a97528f9b7b","description":"Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\\Windows\\System32\\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0.","datePublished":"Aug 19, 2026, 2:35:06 PM","dateUpdated":"Aug 19, 2026, 6:19:27 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","references":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222\nhttps://github.com/gotenberg/gotenberg/issues/662\nhttps://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3\nhttps://github.com/gotenberg/gotenberg/releases/tag/v8.33.0\n","aliases":"CVE-2026-44829\nGHSA-hwc4-gmrw-5222\n","assigner":"GitHub_M","epss":0.5,"enisaIdProduct":[{"id":"d233d4c6-861f-3a24-8f40-c4d65646b4e4","product":{"name":"gotenberg","vendor":{"name":"gotenberg"}},"product_version":"\u003c 8.33.0"}],"enisaIdVendor":[{"id":"a695dccd-964c-3412-91fc-545508bfda26","vendor":{"name":"gotenberg"}}],"enisaIdVulnerability":[{"id":"42b03ff2-95ec-398c-9b1b-36d336e88761","vulnerability":{"id":"CVE-2026-44829","description":"Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\\Windows\\System32\\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0.","datePublished":"Aug 19, 2026, 2:35:06 PM","dateUpdated":"Aug 19, 2026, 6:19:27 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","references":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222\nhttps://github.com/gotenberg/gotenberg/issues/662\nhttps://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3\nhttps://github.com/gotenberg/gotenberg/releases/tag/v8.33.0\n","enisa_id":"EUVD-2026-62427\n","assigner":"GitHub_M","epss":0.5,"dataProcessed":"Oct 30, 2026, 7:18:04 AM","vulnerabilityProduct":[{"id":"df20b742-a50a-3531-9176-5e21c350c2bd","product":{"name":"gotenberg","vendor":{"name":"gotenberg"}},"product_version":"\u003c 8.33.0"}],"vulnerabilityVendor":[{"id":"6ad5f1c1-0157-303d-9074-b330f04453a1","vendor":{"name":"gotenberg"}}]}},{"id":"d0b984ab-c40a-32fc-a3e3-8e7fd28ea4ab","vulnerability":{"id":"GHSA-hwc4-gmrw-5222","description":"Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename","datePublished":"May 29, 2026, 4:38:24 PM","dateUpdated":"May 29, 2026, 4:38:24 PM","baseScore":0.0,"references":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222\nhttps://github.com/gotenberg/gotenberg\nhttps://github.com/gotenberg/gotenberg/releases/tag/v8.33.0\n","enisa_id":"EUVD-2026-62427\n","aliases":"CVE-2026-44829\nGHSA-hwc4-gmrw-5222\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}