Cyber Resilience

CVE-2026-40893

HighPublic PoC

Published: 14 May 2026

Published
14 May 2026
Modified
18 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
EPSS Score 0.0035 26.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-40893 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Thecodingmachine Gotenberg. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and…

more

change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.

CWE(s)
CWE-73CWE-184

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1222 File and Directory Permissions Modification Defense Impairment
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.
attack.mitre.org →
Why these techniques?

Vuln in public-facing PDF API (Gotenberg) directly enables remote file move/rename/permission changes via tag bypass in ExifTool integration (CWE-73), mapping to public app exploitation and permission modification.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-42590Same product: Thecodingmachine Gotenberg
CVE-2026-42591Same product: Thecodingmachine Gotenberg
CVE-2026-42596Same product: Thecodingmachine Gotenberg
CVE-2026-42589Same product: Thecodingmachine Gotenberg
CVE-2026-27018Same product: Thecodingmachine Gotenberg
CVE-2026-42595Same product: Thecodingmachine Gotenberg
CVE-2026-40281Same product: Thecodingmachine Gotenberg
CVE-2026-35458Same product: Thecodingmachine Gotenberg
CVE-2026-42594Same product: Thecodingmachine Gotenberg
CVE-2025-65473Shared CWE-73

Affected Assets

thecodingmachine
gotenberg
≤ 8.31.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-73

Rejects externally supplied file or resource identifiers that fail validity checks.

SI-8 Spam Protection
addresses: CWE-184

Spam filters rely on evolving blacklists, signatures, and heuristics of disallowed message patterns; keeping them updated per the control directly mitigates incomplete disallowed-input lists.

References