Executive brief
Gotenberg is a tool used to convert various document formats into PDF files via a web API. A security flaw allows attackers to bypass safety restrictions and manipulate files on the server, including renaming, moving, or creating links to files. This could lead to unauthorized file access or service disruption, especially in environments where the tool has access to shared storage or sensitive directories.
Technical details
The ExifTool metadata write blocklist in Gotenberg v8 can be bypassed using ExifTool's group-prefix syntax (e.g., 'File:FileName' instead of 'FileName'). The application's validation logic uses a regex that permits colons, allowing prefixed tags to pass through to ExifTool, which then strips the prefix and executes the restricted command. This enables an unauthenticated remote attacker to rename, move, or create symlinks/hardlinks for files within the container. Additionally, certain pseudo-tags like FilePermissions, FileUserID, and FileGroupID were not included in the blocklist at all, allowing modification of file attributes. The vulnerability is a bypass of a previous fix (GHSA-qmwh-9m9c-h36m) and is resolved in version 8.30.0.
Affected products
- Gotenberg Gotenberg < 8.30.0
Timeline
- 2026-04-30: advisory: GitHub security advisory published
- 2026-05-14: disclosed: CVE published to NVD