File and Path Handling

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. Gotenberg: Chromium deny-list bypass via case-insensitive URL schemeCVE-2026-27018gotenberg · CVSS 7.8 · 1.7% likely

   CWE-22

2. Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filenameCVE-2026-44829gotenberg · CVSS 8.8 · 0.5% likely

   CWE-22

3. Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and MoveCVE-2026-40893gotenberg · CVSS 8.2 · 0.3% likely

   CWE-73

4. Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routesCVE-2026-42593gotenberg · CVSS 5.3 · 0.3% likely

   CWE-22

5. Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// schemeCVE-2026-42597gotenberg · CVSS 5.9 · 0.3% likely

   CWE-73

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.