CVE-2020-13452

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.htmlThird Party Advisory, VDB Entry
https://github.com/thecodingmachine/gotenberg/issues/199Third Party Advisory
http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.htmlThird Party Advisory, VDB Entry
https://github.com/thecodingmachine/gotenberg/issues/199Third Party Advisory

Timeline

Published: Jan 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-134588.8An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.CVE-2020-134595.4An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.CVE-2020-13467.8An elevation of privilege vulnerability exists when the Windows Modules Installer improperly handles file operations, aka 'Windows Modules I CVE-2020-134608.8Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were present in Tufin SecureTrack, affecting all versions prior to R20-2 GA.CVE-2020-134614.3Username enumeration in present in Tufin SecureTrack. It's affecting all versions of SecureTrack. The vendor has decided not to fix this vul CVE-2020-134625.7Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA.CVE-2020-134634.6The flash memory readout protection in Apex Microelectronics APM32F103 devices allows physical attackers to extract firmware via the debug i CVE-2020-134644.2The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmwar CVE-2020-134656.8The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execute arbitrary code via CVE-2020-134666.8STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific CVE-2020-134674.6The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmwar CVE-2020-134686.8Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bonding