The vulnerability in Gotenberg allows an attacker to bypass the ExifTool metadata write blocklist by exploiting the tool’s group‑prefix syntax. This bypass enables creation or modification of arbitrary files on the host, including renaming, moving, hardlinking, or symlinking anything within the container’s filesystem. The operation also permits changing file permissions, owner, and group without any prefix restriction. As a result, an attacker who can submit a PDF to the API can alter or create files that may compromise the application, inject malicious code, or facilitate further exploitation.

All versions of Gotenberg before 8.30.0 are affected. This includes deployments where the Gotenberg Docker image is used to provide PDF generation services. The vulnerability has been fixed by updating to version 8.30.0 or later; no other vendor or product versions are reported to be impacted.

The CVSS score of 8.2 classifies this as high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread, known exploits are documented. However, the exposed API typically permits remote users to upload files, making the attack vector likely remote. An attacker could therefore remotely gain the ability to manipulate files on the host, potentially leading to service disruption or unauthorized code execution depending on the application’s privilege boundaries.