CVE-2026-42590 Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Gotenberg can be bypassed using ExifTool's group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. ExifTool supports group-prefix...

CVE-2026-42590

creationtimestamp| type| source ---|---|--- 2026-04-30 18:31:11+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-7v3r-m9c8-r855...