CVE-2026-40893CWE-184CWE-73

Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move

High · published May 14, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00512 · 42.8th percentile
Weaknesses
CWE-184 · Incomplete List of Disallowed Inputs; CWE-73 · External Control of File Name or Path
Published
2026-05-14T15:18Z
EPSS history
Timeline
  • 14 MAY 15:18Z
    Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move
    cvelistv5