Gotenberg RCE Exploitation Deploys Go Backdoor as Second Critical Flaw Comes Under Attack

Attackers exploited CVE-2026-42589 in Gotenberg, an open-source document-to-PDF API, to deploy a custom Go reverse shell called cache_base. VulnCheck observed the activity on a canary in early October 2026, recording 38 events over several days from a residential Japanese IP address. The vulnerability allows unauthenticated remote code execution through unsanitized metadata keys passed to ExifTool by Gotenberg’s PDF metadata-writing endpoint. It carries a CVSS score of 9.8 and was fixed in Gotenberg 8.31.0. The observed attack chain tested command execution, retrieved output and attempted to download the implant from three independent mirrors.

Investigators traced the implant’s command-and-control infrastructure and linked a payload mirror to a GitHub repository containing seven months of development history, additional backdoors, Windows privilege-escalation tools, PHP webshells and suspicious CMS plugins. The repository also held another reverse-shell build using different command-and-control infrastructure. In a separate report, VulnCheck said it detected active exploitation of CVE-2026-40281, another unauthenticated Gotenberg RCE vulnerability rated CVSS 10.0, with roughly 420 Gotenberg instances exposed online. Organizations should identify internet-accessible deployments, restrict access and prioritize remediation for both flaws; the reported 8.31.0 fix specifically addresses CVE-2026-42589 and should not be assumed to resolve CVE-2026-40281.