Cyber Posture

CVE-2026-40893

High

Published: 14 May 2026

Published
14 May 2026
Modified
14 May 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
EPSS Score N/A
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40893 is a high-severity External Control of File Name or Path (CWE-73) vulnerability. Its CVSS base score is 8.2 (High).

Operationally, it is not currently listed in the CISA KEV catalog.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-73

Rejects externally supplied file or resource identifiers that fail validity checks.

SI-8 Spam Protection
addresses: CWE-184

Spam filters rely on evolving blacklists, signatures, and heuristics of disallowed message patterns; keeping them updated per the control directly mitigates incomplete disallowed-input lists.

NVD Description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and…

more

change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-73CWE-184

References