CVE-2026-44829

Executive Summary

CVE-2026-44829 is an unauthenticated path traversal (CWE-22) vulnerability in Gotenberg, a Docker-powered stateless API for PDF generation, affecting versions 8.32.0 and earlier. The flaw resides in filename handling within pkg/modules/api/context.go, where the use of filepath.Base on Linux fails to treat backslashes as path separators, allowing Windows-style parent directory components (e.g., ........\Windows\System32\evil.pdf) to survive sanitization. This results in a crafted filename being propagated through the multi-output PDF routes and embedded as a zip entry name in archives generated by archives.FilesFromDisk and archives.Zip.Archive. When a downstream Windows user extracts the returned archive, the embedded path traversal causes an arbitrary file write outside the intended extraction directory. Exploitation carries a CVSS score of 8.8 (High), requires no prior authentication, and impacts confidentiality, integrity, and availability across a chained attack surface. The issue is fixed in Gotenberg version 8.33.0.

Technical Analysis

The vulnerability originates in Gotenberg's filename sanitization routine located in pkg/modules/api/context.go. The code uses Go's filepath.Base function to strip directory components from an uploaded filename. On Linux, the filepath.Base implementation treats only the forward slash (/) as a path separator, per POSIX conventions. Backslashes (\) are not recognized as separators. Consequently, a multipart filename such as ........\Windows\System32\evil.pdf is processed as a single base name — the entire string survives the sanitization attempt unchanged, including the embedded backslash-based traversal sequence.

The unsanitized filename flows through two distinct code paths. First, it is stored as the "original" filename via ctx.diskToOriginal, which maps the on-disk temporary file to its user-supplied original name. Second, for multi-output PDF routes (those generating multiple files), the filename is propagated into the archive construction pipeline via archives.FilesFromDisk and archives.Zip.Archive. These functions create a ZIP archive where each entry's name is derived directly from the original filename without additional sanitization.

The affected endpoints include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes. The attack surface is remote and unauthenticated: an attacker can submit a malicious multipart upload with a crafted filename, or exploit the downloadFrom parameter to cause Gotenberg to fetch a remote resource whose Content-Disposition header contains the malicious filename. Either vector results in a ZIP archive being returned to the attacker containing a zip entry with a path-traversal name.

The exploitation chain is realized on a downstream Windows system. On Windows, backslashes are valid path separators. When a user or automated process extracts the returned ZIP archive using a Windows archive extractor (including built-in Explorer extraction, WinRAR, 7-Zip, or programmatic extraction via .NET or PowerShell), the archive entry ........\Windows\System32\evil.pdf causes the extractor to traverse upwards from the extraction root. The ........ prefix (six dots) resolves through multiple parent directory levels, resulting in the file being written to C:\Windows\System32\evil.pdf (or an equivalent absolute path depending on the starting directory and the exact traversal depth). This achieves arbitrary file write on the Windows host.

It is important to note the vulnerability does not directly compromise the Gotenberg container or the Linux host running it — the arbitrary write occurs on the Windows client machine that extracts the archive. The attack requires user interaction (the victim must extract the archive), which is reflected in the CVSS vector's UI:R component. The S:C (scope changed) in the vector indicates the vulnerability spans security boundaries — the Gotenberg service is the pivot point, while the impact is realized on a different system (the Windows client).

Exploitation Scenarios

Step 1 — Reconnaissance / Target Identification. The attacker scans for exposed Gotenberg instances. Gotenberg typically binds to port 3000 and is often deployed in Docker with the API exposed either directly or behind a reverse proxy. Shodan queries such as Gotenberg or server: Gotenberg can identify publicly accessible instances. The attacker does not require prior authentication; the affected routes are unauthenticated per the CVSS vector (PR:N).

Step 2 — Crafting and Submitting the Malicious Request. The attacker constructs a multipart/form-data POST request to an affected endpoint such as /forms/pdfengines/split. The request includes a file field whose filename parameter is set to ........\Windows\System32\evil.pdf. Alternatively, the attacker can supply a downloadFrom URL pointing to a server they control, where the HTTP response includes a Content-Disposition: attachment; filename="........\Windows\System32\evil.pdf" header. Gotenberg fetches the remote file, applies its Linux-based sanitization (which fails to strip backslashes), and proceeds with the multi-output PDF splitting operation.

Step 3 — Payload Delivery through ZIP Archive. Gotenberg processes the uploaded/fetched file through the multi-output PDF engine, producing multiple output files (e.g., individual pages from a split PDF). These outputs are zipped by archives.FilesFromDisk and archives.Zip.Archive. Because the original filename was not sanitized for backslash traversal, the zip entry for the crafted file is stored with the name ........\Windows\System32\evil.pdf. The resulting ZIP archive is returned to the attacker in the HTTP response.

Step 4 — Downstream Extraction and Arbitrary File Write. The attacker delivers the crafted ZIP archive to a target Windows user (e.g., by hosting it on a website, sending via email, or tricking the victim into downloading it from the Gotenberg instance directly if the attacker can influence the victim's access). When the victim extracts the archive using any Windows-compatible extractor, the backslash-based path traversal causes the file contents to be written to C:\Windows\System32\evil.pdf (or another absolute location determined by the traversal depth and extraction root). This constitutes an arbitrary file write — the attacker can drop executables, modify system files, or plant persistence mechanisms such as scheduled tasks or startup entries.

Note: No public PoC or exploit code is available at the time of writing. The attack chain is inferred from the vulnerability class (CWE-22 path traversal) and the specific code-level details provided in the NVD description.

Impact Assessment

This vulnerability carries a CVSS 3.1 score of 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L. The subscores indicate:

• Availability (A:L): Low — availability impact is limited; the attack does not directly DoS the Gotenberg service.
• Integrity (I:H): High — the core impact; arbitrary file writes on a Windows host allow modification of system files or planting of malicious content.
• Confidentiality (C:L): Low — the attacker can potentially read back modified files or leverage the write primitive for data exfiltration.
• Scope (S:C): Changed — the vulnerability crosses privilege and trust boundaries: the vulnerable component (Gotenberg service) is distinct from the affected component (Windows extraction client).
• User Interaction (UI:R): Required — the targeted Windows user must extract the malicious archive.

Business impact is concentrated in organizations that deploy Gotenberg as a PDF processing service accessed by internal users or external customers. Any environment where:

1. Gotenberg is exposed on the network (internal or external), and
2. users extract generated archives on Windows machines

is at risk. The "blast radius" extends from the Gotenberg service itself to every Windows endpoint where archive extraction occurs. For organizations with centralized archive-processing automation (e.g., document management pipelines that auto-extract ZIP files), the attack can be weaponized without user interaction, escalating the severity significantly. The attacker-controlled arbitrary write primitive can serve as a foothold for ransomware deployment, privilege escalation (e.g., overwriting executables run by SYSTEM), or lateral movement via planted malicious binaries.

Detection Guidance

Sigma Rule

title: Gotenberg Zip Slip Filename Traversal - Backslash Directory Components
id: 5f8d9c1e-2b4a-4e6f-9c3d-1a2b3c4d5e6f
status: experimental
description: Detects attempts to exploit CVE-2026-44829 by submitting filenames containing backslash-based path traversal sequences to Gotenberg API endpoints.
logsource:
    category: webserver
    product: gotenberg
    definition: 'Requires access logs from the Gotenberg container or reverse proxy in front of it.'
detection:
    selection_traversal:
        cs-uri-query|contains:
            - '\\'
    selection_paths:
        cs-uri-query|contains:
            - '/forms/pdfengines/split'
            - '/forms/libreoffice/convert'
            - '/forms/pdfengines/merge'
    selection_filename:
        cs-user-agent|contains: 'Gotenberg'
    condition: selection_traversal and selection_paths
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026-44829
    - cwe.22
falsepositives:
    - Legitimate API calls that include backslashes in filenames (unlikely but possible on Windows-based clients calling the API directly).

YARA Rule

rule Gotenberg_Zip_Slip_Traversal_Filename
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects ZIP archives containing entries with backslash-based path traversal sequences targeting Windows, indicative of CVE-2026-44829 exploitation."
        date = "2026-01-30"
        severity = "high"
        cve = "CVE-2026-44829"
    strings:
        $zip_local_header = { 50 4B 03 04 }
        $traversal_a = /\.\.\\/ ascii wide
        $traversal_b = /\\[A-Za-z]:\\/ ascii wide
        $traversal_c = /.\.\..\\/ ascii wide
    condition:
        $zip_local_header at 0 and
        ( $traversal_a or $traversal_b or $traversal_c )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-44829 Gotenberg Zip Slip - Backslash Traversal in Filename"; flow:to_server,established; content:"/forms/pdfengines/split"; http_uri; content:"\"; http_uri; pcre:"/filename=\"[^\"]*\\\\[^\"]*\"/Ui"; classtype:attempted-user; sid:1009847; rev:1; metadata:cve CVE-2026-44829, cwe CWE-22, mitre_attack T1190;)

Elastic Detection

sequence by host.ip, process.executable with maxspan=5m
  [ file where event.action == "write" and file.name : "*\\*" ]
  [ process where event.action == "start" and process.args : "*unzip*" or process.args : "*Expand-Archive*" or process.name : ("explorer.exe", "7z.exe", "winrar.exe") ]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog
| search EventID=4688 OR EventID=1
| regex CommandLine="(unzip|Expand-Archive|7z|winrar)[^\"]*"
| join type=inner process_id
    [ search index=windows sourcetype=WinEventLog:Security EventID=4663
      | eval filename_lower=lower(ObjectName)
      | where like(filename_lower, "%\\\\%") ]
| eval cve_match = if(match(ObjectName, "\\.\\.\\\\.*") OR match(ObjectName, "\\\\[A-Za-z]:\\\\"), "CVE-2026-44829", "normal")
| where cve_match = "CVE-2026-44829"
| table _time, host, user, process_name, ObjectName
| sort - _time

Wazuh OSSEC Rule

<group name="gotenberg,">
  <rule id="100847" level="12">
    <decoded>alert</decoded>
    <field name="url">/forms/pdfengines/split|/forms/libreoffice/convert</field>
    <regex>filename="[^"]*\\[^"]*</regex>
    <description>CVE-2026-44829 - Gotenberg backslash path traversal in multipart filename detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve-2026-44829,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; CVE-2026-44829 is confirmed unpatched in all versions prior to 8.33.0. The vendor has not yet published a formal advisory, and no patch artifacts (e.g., CVE fix commit, release notes, or security bulletin) have been detected.

1. Immediate Mitigations (until patched):

• Restrict Network Exposure: Ensure Gotenberg is not directly reachable from the internet. Place it behind an internal network boundary, API gateway, or reverse proxy with allow-listed IPs (e.g., only the application server's IP).
• Disable Unused Routes: If the multi-output PDF, LibreOffice, or conversion routes (/forms/pdfengines/split, etc.) are not business-critical, disable or block them at the reverse proxy level using URL filtering rules.
• Sanitize at the Proxy Layer: Configure the reverse proxy (Nginx, HAProxy) to reject multipart requests whose filename parameter contains a backslash (\). Example Nginx rule: if ($http_content_disposition ~* "\\\\") { return 403; }
• Educate Windows Users: Notify policy — do not extract ZIP archives generated by Gotenberg on Windows without first scanning them. Deploy a security tool that blocks path traversal during archive extraction.

2. Patch/Upgrade Steps:

• Monitor the Gotenberg GitHub releases page (https://github.com/gotenberg/gotenberg) for version 8.33.0.
• Upon release, upgrade to 8.33.0 or later. If using Docker: docker pull gotenberg/gotenberg:8.33.0 and re-deploy the container.
• Verify the fix by re-testing with a crafted filename containing backslash traversal.

3. Long-Term Hardening:

• Implement a WAF: Deploy a Web Application Firewall (e.g., Cloudflare, AWS WAF) with managed rules for path traversal (CWE-22) to block \ and ..\ patterns in multipart filenames.
• Centralized Archive Security: Use an extraction library with built-in traversal protection (e.g., Python's zipfile with sanitization) on any downstream automation that processes Gotenberg archives.
• Continuous Monitoring: Enable audit logging on Gotenberg access logs and integrate with SIEM (Splunk, Elastic, Wazuh) using the detection rules above.
• Asset Inventory: Identify all Gotenberg deployments in the environment and track their versions; prioritize patching once 8.33.0 is available.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-44829 — Official NVD record with description, CVSS 3.1 vector, and CWE-22 classification.
2. Gotenberg GitHub Repository: https://github.com/gotenberg/gotenberg — Monitor for release 8.33.0 containing the fix; check releases notes and CHANGELOG for commit referencing the filename sanitization fix.
3. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique mapping for this vulnerability.
4. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html — Common Weakness Enumeration reference for improper limitation of a pathname to a restricted directory.
5. Gotenberg Official Documentation: https://gotenberg.dev/docs/ — Reference for API endpoints and configuration; useful for validating exposure of /forms/pdfengines/split and related routes.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known threat actor campaigns or public exploit-in-the-wild evidence exists as of the report date. The vulnerability is unpatched and no PoC has been observed. However, given the public availability of the affected software (Docker image), the unauthenticated attack surface, and the high CVSS score, exploitation is considered plausible in the near term. Organizations are advised to treat this as a priority patching item once the vendor release becomes available.