CVE-2026-46652— Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
Quick assessment
Affected
intranda goobi-viewer-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Goobi Viewer 是一款允许在 Web 浏览器中展示数字化资源的 Web 应用程序。在从版本 24.03 到 26.05 之前（不含 26.05）的版本中， 方法从服务器提供的 响应头中提取目标文件名，并直接将其传递给 ，而未剥离其中的目录路径组件。这使得攻击者可以控制 Goobi Viewer 所请求的恶意 HTTP 服务器，在响应头中提供绝对路径或包含 的路径遍历序列作为文件名，从而将攻击者控制的内容写入 Tomcat 进程可写的任意路径。若攻击目标为已部署的 Web 应用程序目录，则可在 Tomcat
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| intranda | goobi-viewer-core | >= 24.03, < 26.05 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-46652
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
Source: CVE Program / CVE List V5
Vulnerability Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| intranda | goobi-viewer-core | >= 24.03, < 26.05 | - |
|
II. Public POCs for CVE-2026-46652
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46652
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-46652 (1)
Vendor Pages for CVE-2026-46652 (1)
-
🔗 Release Release v26.05 · intranda/goobi-viewer-core · GitHub x_refsource_MISC
Same Patch Batch · intranda · 2026-10-23 · 11 CVEs total
| CVE-2026-46651 | 9.8 CRITICAL | Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi |
| CVE-2026-55486 | 9.3 CRITICAL | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected |
| CVE-2026-55457 | 7.4 HIGH | Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorizati |
| CVE-2026-55459 | 7.4 HIGH | Goobi viewer: OpenID JWT audience not enforced by the verifier |
| CVE-2026-46347 | 6.8 MEDIUM | Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Rese |
| CVE-2026-55463 | 6.5 MEDIUM | Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation |
| CVE-2026-46346 | 6.5 MEDIUM | Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset |
| CVE-2026-55442 | 5.3 MEDIUM | Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection |
| CVE-2026-55465 | 5.3 MEDIUM | Goobi viewer: Solr injection via unvalidated region parameter in spatial search |
| CVE-2026-55444 | 5.3 MEDIUM | Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters |
IV. Related Vulnerabilities
Same product: goobi-viewer-core
-
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — C -
CVE-2026-55465
Goobi viewer: Solr injection via unvalidated region paramete -
CVE-2026-55463
Goobi viewer: WebSocket endpoints lack server-side authentic -
CVE-2026-55459
Goobi viewer: OpenID JWT audience not enforced by the verifi -
CVE-2026-55457
Goobi viewer: Empty webapi.authorization.token default permi
Same vendor: intranda
-
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — C -
CVE-2026-55465
Goobi viewer: Solr injection via unvalidated region paramete -
CVE-2026-55463
Goobi viewer: WebSocket endpoints lack server-side authentic -
CVE-2026-55459
Goobi viewer: OpenID JWT audience not enforced by the verifi -
CVE-2026-55457
Goobi viewer: Empty webapi.authorization.token default permi
Same weakness: CWE-22
-
CVE-2026-115800
UbiquitousLearning mllm Convertor __init__.py load_model pat -
CVE-2026-115569
Fallow: Jest and Vitest `projects` entries let an analyzed r -
CVE-2026-114623
baserCMS: Path traversal in the BcThemeFile admin screen all -
CVE-2026-114622
baserCMS: Encoded path traversal bypass in the theme file AP -
CVE-2026-57208
Entire CLI: Path traversal in checkpoint session metadata al
V. Comments for CVE-2026-46652
No comments yet