Goobi viewer: Path traversal via Content-Disposition enables code execution
Summary
Goobi viewer core from 24.03 before 26.05 takes the destination filename of downloaded external files from the Content-Disposition response header of the remote server without removing directory components. A malicious HTTP server that the viewer fetches from can therefore write files to arbitrary paths writable by the Tomcat process. Writing into the deployed web application directory results in remote code execution as the tomcat user. The vulnerability is rated critical (CVSS 9.8); the attacker needs the viewer to fetch a file from an attacker-controlled server.
Affected
- intranda goobi-viewer-core from 24.03 up to but not including 26.05
Fixed in
- Upgrade to goobi-viewer-core 26.05 or later
Workaround
- No workaround for the path traversal is documented.
- Restricting outbound HTTP connections from the viewer host to known sources reduces the risk, but is only partial mitigation.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- EPSS 0.00703 (low).
Our recommendation
- Check whether goobi-viewer-core is installed and which version runs.
- Upgrade to 26.05 as a priority if an affected version is in use.
- Run Tomcat with least-privilege file permissions so it cannot write to the webapp directory.
- Restrict outbound HTTP connections from the viewer host.
- Check the deployed webapp and Tomcat directories for unexpected files.
- Also check exposure to the related CVE-2026-46651.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA-r386-2frm-w3v6 (vendor advisory) github.com
- Release v26.05 github.com
- Fix commit 5281245 github.com
- VulDB CVE-2026-46652 vuldb.com
- GHSA-79jg-3m2m-jgc8 (sibling advisory) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:42.
Original description (NVD)
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.