Path Traversal Vulnerability in Goobi Viewer by Intranda

CVE-2026-46652

What is CVE-2026-46652?

The Goobi Viewer web application is vulnerable to a path traversal issue due to improper handling of the Content-Disposition response header in ExternalFilesDownloader.getFilename(). This flaw allows a remote attacker to exploit this by providing a crafted filename, resulting in potentially harmful content being written to arbitrary locations where the Tomcat process has write access. This vulnerability can lead to remote code execution on the server if the deployment directory of the web application is targeted. This issue has been resolved in Goobi Viewer version 26.05.

References