CVE-2026-40281: Critical Gotenberg flaw scores CVSS 10.0

Gotenberg 8.30.1 and earlier contain a bypass of the earlier metadata-key fix: only the key was validated, so a newline in the value injects arguments into ExifTool. An unauthenticated attacker can move or overwrite files inside the container as root. Fixed in 8.31.0.

• CVSS 3.1 score is 10.0, classified as CWE-88 argument injection
• The 8.30.1 patch validated only the key before the "=", leaving the value unchecked
• Injected -FileName, -Directory, -SymLink and -HardLink pseudo-tags act as root
• The flaw is fixed in Gotenberg 8.31.0