Vulnerability · Published May 14, 2026 · Assigned by GitHub_M
CVE-2026-40893Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move
High 8.2
In plain English
A high-severity security flaw in gotenberg from gotenberg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.3%top 71.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/gotenberg/gotenberg/v7 | no fix listed | GO-2026-5162 |
| Go | github.com/gotenberg/gotenberg/v8 | no fix listed | GHSA-62p3-hvxx-fxg4 |
| Go | github.com/gotenberg/gotenberg/v8 | no fix listed | GO-2026-5162 |
Affected products (as reported)
Weakness: CWE-73, CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
References
- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-62p3-hvxx-fxg4 x_refsource_CONFIRM