CVE-2026-44829: Gotenberg Path Traversal Vulnerability

CVE-2026-44829 Overview

CVE-2026-44829 is a path traversal vulnerability [CWE-22] in Gotenberg, a Docker-powered stateless API for generating PDF files. Versions 8.32.0 and earlier fail to sanitize backslash characters in supplied filenames. The filepath.Base function on Linux does not treat backslashes as path separators, so Windows-style parent directory components survive sanitization. Attackers can supply a crafted filename that later becomes a zip entry name in a returned archive. When a downstream Windows user extracts that archive, the extractor writes files outside the intended directory. The issue is fixed in version 8.33.0.

Critical Impact
A remote unauthenticated attacker can achieve arbitrary file writes on downstream Windows systems that extract Gotenberg-produced archives, enabling code execution through overwrites of startup or configuration files.

Affected Products

Gotenberg 8.32.0 and all earlier 8.x releases
Gotenberg endpoints including /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes
Downstream Windows extractors consuming Gotenberg zip output

Discovery Timeline

2026-08-19 - CVE-2026-44829 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-44829

Vulnerability Analysis

The flaw lives in pkg/modules/api/context.go, where Gotenberg normalizes uploaded filenames using filepath.Base followed by NFC normalization. Because Gotenberg containers run Linux, the Go standard library treats only forward slashes as path separators. Backslashes pass through unchanged. The resulting name flows through ctx.diskToOriginal and into archives.FilesFromDisk and archives.Zip.Archive, becoming the entry name inside a returned zip archive.

When a Windows-based user or automated process extracts that archive, the Windows path parser interprets \ as a directory separator. A payload such as ........\Windows\System32\evil.pdf escapes the extraction directory. The pattern is a classic Zip Slip primitive, but the injection point sits on a Linux server that never recognized the traversal sequence as dangerous.

Root Cause

The root cause is inconsistent path separator handling across operating systems. filepath.Base on Linux strips forward-slash segments only, leaving backslash-delimited traversal sequences intact inside the sanitized string. Because the sanitized string is later reused as an archive entry name consumed by Windows tooling, the platform mismatch converts an ordinary filename field into a traversal vector.

Attack Vector

An unauthenticated remote attacker submits a crafted filename through a multipart upload or through the Content-Disposition header of an upstream downloadFrom source. The attacker supplies a filename containing ..\ sequences targeting a sensitive Windows path. Gotenberg processes the request normally and returns a zip archive. When the archive reaches a Windows host and is extracted by a vulnerable extractor, files are written outside the intended output directory, enabling overwrites of startup scripts, scheduled task definitions, or user profile files.

// Security patch in pkg/modules/api/context.go
// Source: https://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3

-				// Avoid directory traversal and make sure filename characters are
-				// normalized.
+				// Strip path separators (including backslashes) and control
+				// characters, then NFC-normalize. Defends against directory
+				// traversal in the on-disk name and Windows-side Zip Slip
+				// when the original filename is later embedded in an output
+				// zip entry.
 				// See: https://github.com/gotenberg/gotenberg/issues/662.
-				filename = norm.NFC.String(filepath.Base(filename))
+				filename = sanitizeFilename(filename)

The patch replaces the naive filepath.Base call with a dedicated sanitizeFilename helper that strips both forward and backslash separators along with control characters.

Detection Methods for CVE-2026-44829

Indicators of Compromise

Multipart upload requests to Gotenberg routes containing filenames with backslashes or ..\ sequences
Content-Disposition response headers on upstream downloadFrom sources containing backslash-delimited traversal payloads
Zip archives returned by Gotenberg whose entry names contain \ or .. components
Unexpected file writes to Windows system directories on hosts that consume Gotenberg output

Detection Strategies

Inspect HTTP request bodies to Gotenberg endpoints for filename fields containing \ characters and reject or alert on matches
Enumerate archives produced by Gotenberg and flag any zip entries whose names contain .. segments or backslashes
Correlate Gotenberg request logs with file-creation events on Windows extractor hosts to identify writes outside expected output paths

Monitoring Recommendations

Log full multipart filename values at the Gotenberg reverse proxy tier for retrospective analysis
Enable file integrity monitoring on Windows hosts that automatically extract Gotenberg archives, focusing on %APPDATA%, %PROGRAMDATA%, and system directories
Track Gotenberg version strings across container inventories to identify hosts still running 8.32.0 or earlier

How to Mitigate CVE-2026-44829

Immediate Actions Required

Upgrade Gotenberg to version 8.33.0 or later on all container images and Kubernetes deployments
Audit downstream Windows extractors to confirm they reject zip entries containing .. or absolute path components
Restrict network access to Gotenberg instances so only trusted services can submit conversion requests

Patch Information

The fix is available in Gotenberg 8.33.0. See the GitHub Security Advisory GHSA-hwc4-gmrw-5222, the patch commit, and the 8.33.0 release notes. Background context is available in the upstream issue thread.

Workarounds

Place Gotenberg behind a reverse proxy that strips or rejects filenames containing backslashes before they reach the API
Sanitize Content-Disposition headers returned by upstream sources feeding the downloadFrom parameter
Extract Gotenberg archives only on Linux hosts, or use a hardened extractor that validates entry paths against a canonical output directory

bash

# Example nginx snippet to block filenames containing backslashes
# Applied at the reverse proxy in front of Gotenberg
location / {
    if ($request_body ~* "filename=\"[^\"]*\\\\") {
        return 400;
    }
    proxy_pass http://gotenberg_upstream;
}