CVE-2026-40893 Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move
Attackers can bypass ExifTool tag blocklists to rename or move arbitrary files, potentially leading to privilege escalation or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40893?
CVE-2026-40893 is a high-severity path traversal vulnerability in gotenberg, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.
Which versions are affected by CVE-2026-40893?
4 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v8 and github.com/gotenberg/gotenberg/v7. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gotenberg/gotenberg/v8 Go | All versions | None |
github.com/gotenberg/gotenberg/v8 Go | All versions to 8.30.1 | None |
github.com/gotenberg/gotenberg/v8 Go | All versions to 8.30.1 | None |
github.com/gotenberg/gotenberg/v7 Go | All versions | None |
Products include Thecodingmachine Gotenberg.
How do I fix CVE-2026-40893?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40893 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40893 exists.
Other vulnerabilities in gotenberg
Sources
Also known as GHSA-62p3-hvxx-fxg4, GO-2026-5162.