high severity · published 2026-08-19
Gotenberg keeps Windows-style parent folder parts in uploaded file names, and they end up as zip entry names. A remote attacker can use this to make an archive that writes files outside its folder when it is unpacked.
CVE: CVE-2026-44829
Source: NVD
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 183 and your operating system.