CVE-2026-40893: Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move
Vulnerability summary
CVE-2026-40893 is a high (CVSS 8.2) External Control of File Name or Path vulnerability in gotenberg. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 14-05-2026PublishedVulnerability first disclosed.
- 14-05-2026Last modifiedVulnerability information updated.
Description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
Decrease -0.17 pp
From 0.51% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundGotenberg
Maturity: poc
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/gotenberg/gotenberg2 products
- v7All versions (No fix recorded)
- v8≤ 8.30.1 | All versions (No fix recorded)
Gotenberg1 product
- gotenberg< 8.31.0
Thecodingmachine1 product
- gotenberg< 8.31.0
3 vendors · 4 products
References
3 links- github.com/gotenberg/gotenberg/security/advisories/GHSA-62p3-hvxx-fxg4X Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
