Vulnerabilities · 23h ago

Gotenberg exploit points to a wider maintained toolkit

In early October 2026, VulnCheck recorded 38 canary events as an attacker exploited Gotenberg CVE-2026-42589 to deploy a Go reverse shell, then traced a payload mirror to a GitHub repository with seven months of development history. The repository contained multiple backdoors and tools for Windows, PHP, and content-management systems, including another build of the shell configured for different command-and-control infrastructure.

Gotenberg passes PDF metadata to ExifTool. The attacker put line breaks in a metadata key so ExifTool treated part of it as an argument to run Perl code. The attacker then returned command output inside the PDF’s Subject metadata, confirming execution through the normal API response. That gives an attacker command execution on the Gotenberg host.

For teams whose Gotenberg service accepts untrusted requests, patching closes this route but does not show whether the host was already accessed. The repository shows a broader toolkit exists; VulnCheck’s report does not establish that its other components were deployed on the compromised host.

Timeline

• Oct 26 Reported by VulnCheck

Sources

1 source covering this story

• VulnCheck Oct 26

  Cache Me If You Can: Unpacking a Go Implant and Its Toolkit | Blog | VulnCheck

  An investigation into Gotenberg CVE-2026-42589 exploitation in VulnCheck Canary Intelligence led us to cache_base, a custom Go reverse shell, and a much larger multi-platform toolkit.

Entities

• CVE-2026-42589

Part of the PlainSec briefing for 2026-10-26

Editions

• Briefing for 2026-10-26

Related stories

• Arista VeloCloud flaw grants low-privilege users operator access
• Ruby regex bugs expose applications beyond GitLab
• Trimble Cityworks flaw opens IIS servers to attackers