Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.

Affected: Go: github.com/gotenberg/gotenberg/v8

### Summary

Gotenberg blocks certain ExifTool tag names like `FileName` and `Directory` to stop attackers from renaming or moving files on the server. But ExifTool allows a longer form of the same tag — `System:FileName` — which does the exact same thing. Gotenberg only checks if the tag is exactly `FileName`, so `System:FileName` slips right through and ExifTool happily renames the file. No login is needed. One HTTP request is enough.

This bypasses the fix from [GHSA-qmwh-9m9c-h36m](https://github.com/gotenberg/gotenberg/security/advisories/GHSA-qmwh-9m9c-h36m).

### Details

Think of it like a nightclub bouncer with a blocklist of banned names. The blocklist says "Block anyone named **John**." A person shows up and says "I'm **Mr. John**." The bouncer checks — "Mr. John" is not "John" — so he lets them in. But inside the club, everyone knows Mr. John IS John.

That's exactly what happens here:

**The blocklist** (`exiftool.go` line 275-280) blocks these tag names:

``` FileName Directory HardLink SymLink ```

**The check** (`exiftool.go` line 295-301) compares what the user sent against this list:

```go if strings.EqualFold(key, tag) { // is "System:FileName" equal to "FileName"? delete(metadata, key) // no — so it's NOT deleted } ```

`System:FileName` is not equal to `FileName` (one is 16 characters, the other is 8), so it passes through.

**But ExifTool treats them as the same thing.** In ExifTool, `System:` is just a group prefix — like a folder nam…