Vulnerability Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492f
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-r386-2frm
FAQ
What is CVE-2026-46652?
CVE-2026-46652 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the de...
How severe is CVE-2026-46652?
CVE-2026-46652 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-46652?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.