https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:30:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318576 EUVD-2026-318576 https://cve.radiocsirt.org/vuln/euvd-2026-318576 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40893 <p>Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.</p> <p>Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40893 https://cve.radiocsirt.org/vuln/ghsa-62p3-hvxx-fxg4 <p><strong>Affected:</strong> Go: github.com/gotenberg/gotenberg/v8</p> <p>### Summary</p> <p>Gotenberg blocks certain ExifTool tag names like `FileName` and `Directory` to stop attackers from renaming or moving files on the server. But ExifTool allows a longer form of the same tag — `System:FileName` — which does the exact same thing. Gotenberg only checks if the tag is exactly `FileName`, so `System:FileName` slips right through and ExifTool happily renames the file. No login is needed. One HTTP request is enough.</p> <p>This bypasses the fix from [GHSA-qmwh-9m9c-h36m](https://github.com/gotenberg/gotenberg/security/advisories/GHSA-qmwh-9m9c-h36m).</p> <p>### Details</p> <p>Think of it like a nightclub bouncer with a blocklist of banned names. The blocklist says &#34;Block anyone named **John**.&#34; A person shows up and says &#34;I&#39;m **Mr. John**.&#34; The bouncer checks — &#34;Mr. John&#34; is not &#34;John&#34; — so he lets them in. But inside the club, everyone knows Mr. John IS John.</p> <p>That&#39;s exactly what happens here:</p> <p>**The blocklist** (`exiftool.go` line 275-280) blocks these tag names:</p> <p>``` FileName Directory HardLink SymLink ```</p> <p>**The check** (`exiftool.go` line 295-301) compares what the user sent against this list:</p> <p>```go if strings.EqualFold(key, tag) { // is &#34;System:FileName&#34; equal to &#34;FileName&#34;? delete(metadata, key) // no — so it&#39;s NOT deleted } ```</p> <p>`System:FileName` is not equal to `FileName` (one is 16 characters, the other is 8), so it passes through.</p> <p>**But ExifTool treats them as the same thing.** In ExifTool, `System:` is just a group prefix — like a folder nam…</p> <p><strong>Affected:</strong> Go: github.com/gotenberg/gotenberg/v8</p> <p>### Summary</p> <p>Gotenberg blocks certain ExifTool tag names like `FileName` and `Directory` to stop attackers from renaming or moving files on the server. But ExifTool allows a longer form of the same tag — `System:FileName` — which does the exact same thing. Gotenberg only checks if the tag is exactly `FileName`, so `System:FileName` slips right through and ExifTool happily renames the file. No login is needed. One HTTP request is enough.</p> <p>This bypasses the fix from [GHSA-qmwh-9m9c-h36m](https://github.com/gotenberg/gotenberg/security/advisories/GHSA-qmwh-9m9c-h36m).</p> <p>### Details</p> <p>Think of it like a nightclub bouncer with a blocklist of banned names. The blocklist says &#34;Block anyone named **John**.&#34; A person shows up and says &#34;I&#39;m **Mr. John**.&#34; The bouncer checks — &#34;Mr. John&#34; is not &#34;John&#34; — so he lets them in. But inside the club, everyone knows Mr. John IS John.</p> <p>That&#39;s exactly what happens here:</p> <p>**The blocklist** (`exiftool.go` line 275-280) blocks these tag names:</p> <p>``` FileName Directory HardLink SymLink ```</p> <p>**The check** (`exiftool.go` line 295-301) compares what the user sent against this list:</p> <p>```go if strings.EqualFold(key, tag) { // is &#34;System:FileName&#34; equal to &#34;FileName&#34;? delete(metadata, key) // no — so it&#39;s NOT deleted } ```</p> <p>`System:FileName` is not equal to `FileName` (one is 16 characters, the other is 8), so it passes through.</p> <p>**But ExifTool treats them as the same thing.** In ExifTool, `System:` is just a group prefix — like a folder nam…</p> https://cve.radiocsirt.org/vuln/ghsa-62p3-hvxx-fxg4