Rubrol vs Ghostscript: Why Embedding ZUGFeRD 2.2 with 1990s PostScript Scripts Is an Infrastructure Hazard

Artifex promotes Ghostscript command lines with zugferd.ps as a turnkey way to produce ZUGFeRD e-invoices. But underneath the hood lies an AGPL-3.0 licensing trap, decades of remote code execution CVEs, and complete silence on EN 16931 validation errors. Here is why modern engineering stacks avoid Ghostscript.

The 1990s Legacy Meets 2026 Mandates

Ghostscript is one of the most venerable pieces of open-source software in existence, dating back to 1988. In recent releases, Artifex introduced the zugferd.ps PostScript wrapper script, allowing developers to convert an existing PDF into a PDF/A-3 container with an embedded XML file.

On paper, it looks like a simple bash command:

gs --permit-file-read=/data/ \
   -sDEVICE=pdfwrite \
   -dPDFA=3 \
   -sColorConversionStrategy=RGB \
   -sZUGFeRDXMLFile=/data/factur-x.xml \
   -sZUGFeRDProfile=/data/default_rgb.icc \
   -o /data/output.pdf \
   /usr/share/ghostscript/lib/zugferd.ps \
   /data/input.pdf

In production cloud architecture, however, this command creates three immediate, critical liabilities.

1. The Security Liability: Decades of RCE Vulnerabilities

Ghostscript is a full Turing-complete PostScript language interpreter written in C. Because PostScript allows file manipulation and device interaction, Ghostscript has historically been one of the most targeted binaries for server vulnerabilities:

• CVE-2023-36664: Ghostscript file permission validation bypass.
• CVE-2021-3781: Arbitrary code execution via format string injection.
• CVE-2019-14811 / CVE-2019-14817: Multiple -dSAFER sandbox escapes allowing remote code execution when parsing untrusted PDF objects.

Running Ghostscript inside an automated invoicing pipeline means untrusted input (e.g. customer-uploaded logos, dynamic fonts, or invoice strings) is executed by a complex C engine.

Rubrol eliminates this attack surface entirely. Written in memory-safe Rust, Rubrol has no PostScript interpreter, does not execute shell scripts, and does not require sandbox bypass flags like --permit-file-read.

2. Zero EN 16931 Schema & Business Rule Validation

Here is the most dangerous failure mode of Ghostscript:

When your customer submits that PDF to the French Portail Public de Facturation (PPF) or German DATEV portal, the invoice is instantly rejected, payments are delayed, and tax non-compliance penalties apply.

Rubrol executes strict in-memory schema validation before document assembly. If a calculation fails or a mandatory EU field is absent, Rubrol returns a descriptive JSON error pinpointing the exact rule violation.

3. The AGPL-3.0 Licensing Landmine

Ghostscript is licensed under the GNU Affero General Public License (AGPLv3).

Under AGPLv3, if you run Ghostscript as part of a network-accessible service (like a SaaS billing engine or API), you may be legally required to provide the complete corresponding source code of your entire application to all users interacting with that service.

To avoid open-sourcing their proprietary SaaS backends, companies must purchase commercial OEM licenses from Artifex, often costing \$10,000 to \$30,000+ per year.

Rubrol gives you commercial peace of mind: an open-source Rust CLI and perpetual, self-hosted Rubrol Vault licenses with zero copyleft contagion and no recurring per-seat fees.

The Verdict

Ghostscript is an indispensable tool for printing houses and PostScript prepress workflows. But for modern microservices handling EU e-invoicing compliance, relying on PostScript scripts introduces intolerable security vulnerabilities, license liability, and zero validation protection.

Rubrol is built specifically for 2026: safe, blazing fast, and natively compliant.