HIGHCVE-2026-40893Published Modified CNA GitHub_M
CVE-2026-40893: Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.
Metrics
- CVSS v3.1
- 8.2
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 1
Affected packages
- gotenberg / gotenberg< 8.31.0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L