Critical severity9.8NVD Advisory· Published Jan 7, 2021· Updated Jun 17, 2026

CVE-2020-13450

Description

A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. This can lead to DoS, a change to program behavior, or code execution.

Affected products

Gotenberg/Gotenberg3 versions
cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*range: <=6.2.1
- (no CPE)
- (no CPE)range: <=6.2.1

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.htmlnvdExploitThird Party AdvisoryVDB Entry
github.com/thecodingmachine/gotenberg/issues/199nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000