A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• thecodingmachine gotenbergup to 6.2.1 inclusive

Other highest-scoring records for the same primary product.

• CVE-2020-13450A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writab
  41Plan
• CVE-2026-42589Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
  40Plan
• CVE-2020-13452In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file,
  40Plan
• CVE-2020-13451An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice co
  40Plan
• CVE-2026-42596Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
  38Monitor
• CVE-2026-40281Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
  36Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.