Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)
Date: 2026-04
Affected: go/github.com/gotenberg/gotenberg/v8
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-27018
CVE-2026-40280
CVE-2026-40281
CWE: CWE-22
CWE-88
CWE-918
CVSS: 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H)

## Vulnerability Details **CWE**: CWE-20 - Improper Input Validation The metadata value sanitization introduced in v8.30.1 (commit 405f106) only validates metadata KEYS via safeKeyPattern regex. Metadata VALUES are passed unsanitized to go-exiftool SetString(), which writes them as fmt.Fprintln(e.stdin, "-"+k+"="+str). A newline (\n) in a value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, -HardLink. Docker-verified: HTTP 404 returned (file moved), /tmp/inject_proof created in container. This is a bypass of the incomplete fix in v8.30.1. ## Summary The metadata write endpoint in v8.30.1 validates metadata **keys** for control characters (commit 405f106) but leaves metadata **values** unsanitized. go-exiftool's `WriteMetadata` sends each key/value pair to ExifTool's stdin as: ``` fmt.Fprintln(e.stdin, "-"+k+"="+str) ``` A `\n` character in `str` splits this into two separate stdin lines, injecting an arbitrary ExifTool pseudo-tag argument. The attacker controls what comes after the newline, enabling injection of `-FileName`, `-Directory`, `-SymLink`, `-HardLink`, and other dangerous pseudo-tags — the exact tags the key blocklist was designed to prevent. ## Root Cause `pkg/modules/exiftool/exiftool.go` — `WriteMetadata()` function: ```go // KEY validation added in v8.30.1 (commit 405f106) for key := range metadata { if !safeKeyPattern.MatchString(key) { // ←


Mitigations:

Architectural layers (MAESTRO):