CVE-2026-46652 Details

A critical path traversal vulnerability has been identified in Goobi Viewer versions 24.03 prior to 26.05. The issue arises in the ExternalFilesDownloader component, where the getFilename() method extracts the filename from a server-supplied Content-Disposition header and passes it to Path.resolve() without removing directory components. This flaw enables a malicious HTTP server to manipulate the filename, using absolute paths or ../ traversal sequences, to write content to arbitrary locations accessible by the Tomcat process. Targeting the web application directory can result in remote code execution as the Tomcat OS user.

Users can update to Goobi Viewer version 26.05 or later, where this vulnerability has been patched. Additionally, the vulnerable WebSocket endpoint can be blocked or secured through Apache httpd vhost configurations or Tomcat web.xml security constraints.