StackRadarChart IndexLive demo

CVE-2026-42590

High

Advisory

Published 7 May 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 8; of 17,781 indexed, latest versions
Container images: 6; deployed by those charts
Fix available: None; affected package

Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist

Carried by container images the latest versions of 8 of 17,781 indexed charts deploy, on 6 images.

Affected package	Affected versions	Fixed in	Images
github.com/gotenberg/gotenberg/v8golang	v8.25.1, v8.30.1, v8.34.0, v8.36.0+1 more	no fix listed	6

OSV records: GHSA-7v3r-m9c8-r855 GO-2026-5234

Charts affected

8 by stars

Chart

Latest

Affected images

Radar Score

gotenbergmaikumori

1 of 1 See more

gotenberg maikumori 1.25.0

1 of the 1 container images this version deploys carry CVE-2026-42590.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.36.0	87c16b9f3642	github.com/gotenberg/gotenberg/v8@v8.36.0	no fix listed

Open the chart page →

9,683

paperless-ngxadnoctem

1 of 5 See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-42590.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.36.0	87c16b9f3642	github.com/gotenberg/gotenberg/v8@v8.36.0	no fix listed

Open the chart page →

19,691

gotenbergadnoctem

1 of 1 See more

gotenberg adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-42590.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.37.0	f29984bd1e22	github.com/gotenberg/gotenberg/v8@v8.37.0	no fix listed

Open the chart page →

5,582

platform-apiappscode

1 of 3 See more

platform-api appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-42590.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	github.com/gotenberg/gotenberg/v8@v8.25.1	no fix listed

Open the chart page →

37,268

gotenbergbysamio

1 of 1 See more

gotenberg bysamio 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42590.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8-chromium	a40f92d7419a	github.com/gotenberg/gotenberg/v8@v8.36.0	no fix listed

Open the chart page →

8,978

damap-chartdamap

1 of 5 See more

damap-chart damap 0.3.0

1 of the 5 container images this version deploys carry CVE-2026-42590.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8	f29984bd1e22	github.com/gotenberg/gotenberg/v8@v8.37.0	no fix listed

Open the chart page →

13,936

1 of 5 See more

paperless hp 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-42590.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.34	67097317623a	github.com/gotenberg/gotenberg/v8@v8.34.0	no fix listed

Open the chart page →

26,612

kbot-self-hostedkbot-self-hosted

1 of 7 See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-42590.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.30	206a6c708fc6	github.com/gotenberg/gotenberg/v8@v8.30.1	no fix listed

Open the chart page →

32,509

Container images carrying it

6 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
gotenberg/gotenberg :8.36.0	87c16b9f3642	github.com/gotenberg/gotenberg/v8@v8.36.0	no fix listed	2
gotenberg/gotenberg :8 :8.37.0	f29984bd1e22	github.com/gotenberg/gotenberg/v8@v8.37.0	no fix listed	2
gotenberg/gotenberg :8.30	206a6c708fc6	github.com/gotenberg/gotenberg/v8@v8.30.1	no fix listed	1
gotenberg/gotenberg :8.34	67097317623a	github.com/gotenberg/gotenberg/v8@v8.34.0	no fix listed	1
gotenberg/gotenberg :8-chromium	a40f92d7419a	github.com/gotenberg/gotenberg/v8@v8.36.0	no fix listed	1
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	github.com/gotenberg/gotenberg/v8@v8.25.1	no fix listed	1