The file is not executable, but the parser executes it in its own context: > When uploading image files, GitLab Workhorse passes any files with the extensions

The file is not executable, but the parser executes it in its own context: > When uploading image files, GitLab Workhorse passes any files with the extensions jpg|jpeg|tiff through to ExifTool to remove any non-whitelisted tags. > An issue with this is that ExifTool will ignore the file extension and try to determine what the file is based on the content, allowing for any of the supported parsers to be hit instead of just JPEG and TIFF by just renaming the uploaded file. > One of the supported formats is DjVu. When parsing the DjVu annotation, the tokens are evaled to "convert C escape sequences". https://gitlab.com/gitlab-org/gitlab/-/issues/327121 https://gitlab.com/gitlab-org/gitlab/-/issues/327121