{"vulnerability": "CVE-2026-40281", "sightings": [{"uuid": "b7a04544-8b53-4446-ae5b-372e7ec3e455", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7onz4kgp2n", "content": "\ud83d\udd34 CVE-2026-40281 - Critical (10)\n\nGotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the me...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-40281/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-06T21:50:46.950815Z"}, {"uuid": "4a6f64c9-be06-4a6b-9e5f-28c9b436b339", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mla4iyvhh22o", "content": "CVE-2026-40281 - Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values\nCVE ID : CVE-2026-40281\n \n Published : May 6, 2026, 9:16 p.m. | 3\u00a0hours, 4\u00a0minutes ago\n \n Description : Gotenberg is a Docker-powered stateless API for PDF files. In versions 8...", "creation_timestamp": "2026-05-07T01:58:30.976420Z"}, {"uuid": "5b9fb60b-25f8-414c-bebf-35f9f86406b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mllns5obny2w", "content": "\ud83d\udccc CVE-2026-40281 - Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for con... https://www.cyberhub.blog/cves/CVE-2026-40281", "creation_timestamp": "2026-05-11T16:07:14.301499Z"}, {"uuid": "eb4b0d95-b876-45b8-974f-50b7753e15dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://bsky.app/profile/threat-surface.bsky.social/post/3mmeygwa7nm2a", "content": "\ud83d\udd34 CVE-2026-40281: thecodingmachine gotenberg advisory\n\n\n\nhttps://www.youtube.com/shorts/K9OtI30YGD8\n\n##cybersecurity ##infosec ##cve #cybersecurity #infosec", "creation_timestamp": "2026-05-21T17:54:16.206386Z"}, {"uuid": "9e290def-5299-4f80-8bde-7698bb8e8014", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "MISP/d511a704-eba2-411a-9543-41e0e130f522", "content": "", "creation_timestamp": "2026-06-15T17:02:32.000000Z"}, {"uuid": "ed8d79d9-5c42-4404-8825-7738319e869b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://t.me/shimiscyberworld/1255", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-40281 \u2014 CVSS 10\nGotenberg PDF API Vulnerability CVE-2026-40281 Allows Arbitrary File Overwrite\n\nCVE-2026-40281 \u2014 Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characte\n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-40281 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:14.100096Z"}, {"uuid": "104db6e9-d9a9-4af4-a95c-1e9b64211495", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-40281.yaml", "content": "", "creation_timestamp": "2026-09-28T13:54:29.000000Z"}, {"uuid": "8b3ea9fb-5a3d-42f7-80d5-98783ebbd2d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://t.me/GithubRedTeam/103999", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-40281\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xgh057r3c0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-01 22:30:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGotenberg <= 8.30.1 unauthenticated RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-01T23:00:07.000000Z"}, {"uuid": "99124257-b6e2-4400-a98e-f06932f5548c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103999", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-40281\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xgh057r3c0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-01 22:30:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGotenberg <= 8.30.1 unauthenticated RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-01T23:00:07.000000Z"}, {"uuid": "96dfaca6-ad50-466f-8aa0-48746a164831", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "published-proof-of-concept", "source": "Telegram/177RkuJkwXry8NfDCq80KOXeXulGQb7VLEDtfHFepQoK-2w", "content": "", "creation_timestamp": "2026-10-02T09:00:05.000000Z"}, {"uuid": "46896e42-80bb-48ef-ac54-d6c67421e184", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104079", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-42589xCVE-2026-40281-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a codeb0ssx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 14:05:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-42589 & CVE-2026-40281 - GotenBerg\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-02T14:06:54.000000Z"}, {"uuid": "e2213b52-5dbc-4123-b211-ab5a3c36f6e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-40281-exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MRdark-ops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 14:26:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGotenberg 8.30.1 unauthenticated RCE exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-02T15:05:37.000000Z"}, {"uuid": "e9815729-8bdb-4c5b-9e26-7b10ecbac72e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117379081123445713", "content": "\ud83d\udea8 Public exploit released for CVE-2026-40281 affecting Gotenberg\nhttps://github.com/MRdark-ops/CVE-2026-40281-exploit\nA proof-of-concept exploit has been published for CVE-2026-40281, a critical unauthenticated remote code execution vulnerability affecting Gotenberg versions prior to 8.31.0.\nThe flaw affects Gotenberg\u2019s PDF metadata handling and can allow a remote attacker to inject commands through crafted metadata values sent to the /forms/pdfengines/metadata/write endpoint. No authentication or user interaction is required.\nKey details:\u2800\u2022 CVE-2026-40281\u2022 CVSS: 9.1 Critical\u2022 Gotenberg < 8.31.0 affected\u2022 Unauthenticated remote code execution\u2022 Network exploitable\u2022 Low attack complexity\u2022 Public PoC now available\u2022 Fixed in Gotenberg 8.31.0\u2800The published exploit supports vulnerability detection, single-command execution and an interactive shell against vulnerable instances.\nOrganizations running affected Gotenberg deployments should upgrade to version 8.31.0 or later.\n\ud83d\udca5 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing", "creation_timestamp": "2026-10-03T21:24:00.413351Z"}, {"uuid": "aa9dd185-c0dd-4e94-89bc-cc8a9821336f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://t.me/GithubRedTeam/104223", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a -GOTENBERG-RCE-CHAIN\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackfutSecRoot\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-03 21:58:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGotenberg RCE Chain \u2014 CVE-2026-42589 + CVE-2026-40281\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-03T22:12:31.000000Z"}, {"uuid": "88b4f9cc-415c-40b2-baf7-986c0994d6e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwz6bugujx2b", "content": "CVE-2026-40281 is trending. Hype score 8, currently #4 on cvemon.\n\nGotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-40281", "creation_timestamp": "2026-10-04T00:44:00.428397Z"}, {"uuid": "c63ce807-bfb9-4a02-a62a-85ff2478553b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104223", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a -GOTENBERG-RCE-CHAIN\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackfutSecRoot\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-03 21:58:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGotenberg RCE Chain \u2014 CVE-2026-42589 + CVE-2026-40281\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-03T22:12:31.000000Z"}, {"uuid": "a40e2e46-c2b1-49de-a884-90b5cf33445f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-40281\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rabakuku\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-05 00:48:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA Working PoC For CVE-2026-40281\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-05T01:00:07.000000Z"}, {"uuid": "2e7a6d45-dc72-4d4f-b5fe-ed88ec55910e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "Telegram/t34GvEKFChjIxVS0xdw9uop1orNooAtE-uv3UeXX5AmJlwQ", "content": "", "creation_timestamp": "2026-10-05T09:00:05.000000Z"}, {"uuid": "a4a1e15b-4257-48a6-961b-f7eb45f44a39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "published-proof-of-concept", "source": "Telegram/t34GvEKFChjIxVS0xdw9uop1orNooAtE-uv3UeXX5AmJlwQ", "content": "", "creation_timestamp": "2026-10-05T09:00:05.000000Z"}]}