Live › vulnerability › CVE-2026-46652
Go to dashboardGoobi viewer trusts the filename in a remote server's Content-Disposition header when downloading external files, so a malicious server can use ../ or absolute paths to write files anywhere Tomcat can write. Writing into the deployed web application directory gives remote code execution as the tomcat user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the deployed Goobi viewer version; affected if it is 24.03 up to but not including 26.05.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-46652")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.