Vulnerability · Published May 14, 2026 · Assigned by GitHub_M

CVE-2026-42590Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist

High 8.2

In plain English

A high-severity security flaw in gotenberg from gotenberg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Gotenberg can be bypassed using ExifTool's group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. ExifTool supports group-prefix syntax where File:FileName is processed identically to FileName -- the prefix is stripped by SetNewValue in Writer.pl before tag matching. The safeKeyPattern regex (^[a-zA-Z0-9\-_.:]+$) allows colons, so prefixed tag names pass validation. Any prefix works: File:FileName, System:Directory, a:HardLink, etc. Additionally, FilePermissions, FileUserID, and FileGroupID pseudo-tags are not blocked at all and can modify file attributes without any prefix. This vulnerability is fixed in 8.30.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/gotenberg/gotenberg/v7	no fix listed	GO-2026-5234
Go	github.com/gotenberg/gotenberg/v8	no fix listed	GHSA-7v3r-m9c8-r855
Go	github.com/gotenberg/gotenberg/v8	no fix listed	GO-2026-5234

Affected products (as reported)

Vendor	Product	Versions
gotenberg	gotenberg	< 8.30.0

Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-7v3r-m9c8-r855 x_refsource_CONFIRM