Executive brief
Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags
Affected products
- Go github.com/gotenberg/gotenberg/v8
Junglewise Threat Intelligence
Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags
Severity: medium · CVSS 4 · Published 2026-04-07
Technologies: github.com/gotenberg/gotenberg/v8 (Go). Vendors: Go.
Related threats
- Gotenberg SSRF and local file disclosure in LibreOffice conversion
- GO-2026-5587 - Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags in github.com/gote
- GO-2026-5372 - Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature in github.com/gotenberg/gotenberg
- Gotenberg race condition in multipart downloadFrom handling
- Gotenberg SSRF deny-list bypass in IsPublicIP via IPv6 prefixes