{"id":"CVE-2026-46652","published":"2026-10-23T15:17:31.593","lastModified":"2026-10-23T16:28:32.357","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22","CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5","tags":[]},{"url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":[]},{"url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-r386-2frm-w3v6","tags":[]}],"exploitRefs":[{"url":"https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5","tags":[]},{"url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":[]},{"url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-r386-2frm-w3v6","tags":[]}],"hasPoc":true,"ai":{"summary":"The Goobi viewer's ExternalFilesDownloader.getFilename() method extracts filenames from untrusted Content-Disposition headers without sanitizing directory traversal sequences, allowing an attacker-controlled HTTP server to write arbitrary files (including webshells) to the Tomcat process's writable paths, leading to remote code execution.","exploitability":"Exploitation requires control of a server that the vulnerable application fetches from and the ability to serve a malicious Content-Disposition header with path traversal sequences; no authentication or user interaction is needed.","blast_radius":"Successful exploitation grants remote code execution as the Tomcat OS user, potentially compromising the entire host and any downstream systems accessible to that account.","remediation":"Upgrade to Goobi viewer version 26.05 or later, which patches the path traversal vulnerability in ExternalFilesDownloader.getFilename().","detection":"Defenders should monitor for unexpected file creation or modification in the web-application directory (e.g., .jsp, .war, or other webshell-named files) and for outbound HTTP requests to untrusted external servers during file-download operations; no specific log line or network signature is reliably derivable from the description.","tags":["rce","path-traversal","webapp","server-side"],"model":"garnet-coder","analyzedAt":"2026-10-24T09:02:27.204Z"}}