CVE-2026-46652: Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Goobi viewerto a version that resolves this vulnerability.Fixed in 26.05
Event History
Frequently Asked Questions
Which deployments are affected?
Goobi viewer versions 24.03 through versions before 26.05 are affected. Version 26.05 contains the patch.
What does an attacker need to exploit this issue?
The viewer must fetch content from an attacker-controlled HTTP server. The attacker can provide a crafted Content-Disposition filename containing an absolute path or traversal sequences.
What access can exploitation provide?
The attacker can write controlled content to arbitrary locations writable by the Tomcat process. If the deployed web-application directory can be targeted, this can result in remote code execution as the Tomcat operating-system user.
What should be done if this vulnerability applies?
Upgrade Goobi viewer to version 26.05. The provided data does not identify an alternative configuration-based mitigation.