GHSA-7V3R-M9C8-R855

Vulnerability from github – Published: 2026-05-07 00:55 – Updated: 2026-05-14 20:52
VLAI
Summary
Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist
Details

Summary

The ExifTool metadata write blocklist in Gotenberg v8 can be bypassed using ExifTool's group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. This is a bypass of the fix for GHSA-qmwh-9m9c-h36m.

Details

The blocklist in pkg/modules/exiftool/exiftool.go filters four dangerous pseudo-tags (FileName, Directory, HardLink, SymLink) using strings.EqualFold(key, tag). However, ExifTool supports group-prefix syntax where File:FileName is processed identically to FileName -- the prefix is stripped by SetNewValue in Writer.pl before tag matching.

The safeKeyPattern regex (^[a-zA-Z0-9\-_.:]+$) allows colons, so prefixed tag names pass validation. Any prefix works: File:FileName, System:Directory, a:HardLink, etc.

Additionally, FilePermissions, FileUserID, and FileGroupID pseudo-tags are not blocked at all and can modify file attributes without any prefix.

PoC

# Rename the converted PDF (bypasses FileName blocklist)
curl -F "files=@test.pdf" \
  -F 'metadata={"File:FileName":"pwned.pdf"}' \
  http://localhost:3000/forms/pdfengines/metadata/write

# Move the file to /tmp (bypasses Directory blocklist)
curl -F "files=@test.pdf" \
  -F 'metadata={"File:Directory":"/tmp"}' \
  http://localhost:3000/forms/pdfengines/metadata/write

# Create a symlink (bypasses SymLink blocklist)
curl -F "files=@test.pdf" \
  -F 'metadata={"File:SymLink":"/tmp/symlink-poc"}' \
  http://localhost:3000/forms/pdfengines/metadata/write

# Change file permissions (not blocked at all)
curl -F "files=@test.pdf" \
  -F 'metadata={"FilePermissions":"rwxrwxrwx"}' \
  http://localhost:3000/forms/pdfengines/metadata/write

Impact

Pre-auth (no authentication by default). Attacker can rename, move, or create links to files within the Gotenberg container. In deployments with mounted volumes or non-containerized setups, this enables arbitrary file read via symlink chaining and file overwrite via directory manipulation.

This is a direct bypass of the fix for GHSA-qmwh-9m9c-h36m.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gotenberg/gotenberg/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "8.29.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42590"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T00:55:44Z",
    "nvd_published_at": "2026-05-14T16:16:22Z",
    "severity": "HIGH"
  },
  "details": "**Summary**\n\nThe ExifTool metadata write blocklist in Gotenberg v8 can be bypassed using ExifTool\u0027s group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. This is a bypass of the fix for GHSA-qmwh-9m9c-h36m.\n\n**Details**\n\nThe blocklist in `pkg/modules/exiftool/exiftool.go` filters four dangerous pseudo-tags (`FileName`, `Directory`, `HardLink`, `SymLink`) using `strings.EqualFold(key, tag)`. However, ExifTool supports group-prefix syntax where `File:FileName` is processed identically to `FileName` -- the prefix is stripped by `SetNewValue` in `Writer.pl` before tag matching.\n\nThe `safeKeyPattern` regex (`^[a-zA-Z0-9\\-_.:]+$`) allows colons, so prefixed tag names pass validation. Any prefix works: `File:FileName`, `System:Directory`, `a:HardLink`, etc.\n\nAdditionally, `FilePermissions`, `FileUserID`, and `FileGroupID` pseudo-tags are not blocked at all and can modify file attributes without any prefix.\n\n**PoC**\n\n```bash\n# Rename the converted PDF (bypasses FileName blocklist)\ncurl -F \"files=@test.pdf\" \\\n  -F \u0027metadata={\"File:FileName\":\"pwned.pdf\"}\u0027 \\\n  http://localhost:3000/forms/pdfengines/metadata/write\n\n# Move the file to /tmp (bypasses Directory blocklist)\ncurl -F \"files=@test.pdf\" \\\n  -F \u0027metadata={\"File:Directory\":\"/tmp\"}\u0027 \\\n  http://localhost:3000/forms/pdfengines/metadata/write\n\n# Create a symlink (bypasses SymLink blocklist)\ncurl -F \"files=@test.pdf\" \\\n  -F \u0027metadata={\"File:SymLink\":\"/tmp/symlink-poc\"}\u0027 \\\n  http://localhost:3000/forms/pdfengines/metadata/write\n\n# Change file permissions (not blocked at all)\ncurl -F \"files=@test.pdf\" \\\n  -F \u0027metadata={\"FilePermissions\":\"rwxrwxrwx\"}\u0027 \\\n  http://localhost:3000/forms/pdfengines/metadata/write\n```\n\n**Impact**\n\nPre-auth (no authentication by default). Attacker can rename, move, or create links to files within the Gotenberg container. In deployments with mounted volumes or non-containerized setups, this enables arbitrary file read via symlink chaining and file overwrite via directory manipulation.\n\nThis is a direct bypass of the fix for GHSA-qmwh-9m9c-h36m.",
  "id": "GHSA-7v3r-m9c8-r855",
  "modified": "2026-05-14T20:52:13Z",
  "published": "2026-05-07T00:55:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-7v3r-m9c8-r855"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42590"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-qmwh-9m9c-h36m"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gotenberg/gotenberg"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gotenberg\u0027s ExifTool group-prefix syntax bypasses dangerous-tag blocklist"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.