Critical severity9.8NVD Advisory· Published Jan 7, 2021· Updated Jun 17, 2026

CVE-2020-13451

Description

An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros.

Affected products

Gotenberg/Gotenberg3 versions
cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*range: <=6.2.1
- (no CPE)
- (no CPE)range: <=6.2.1

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.htmlnvdExploitThird Party AdvisoryVDB Entry
github.com/thecodingmachine/gotenberg/issues/199nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000