{"id":"CVE-2026-46652","kind":"vulnerability","aliases":["CVE-2026-46652"],"related":[],"title":"Goobi viewer: remote server headers can write files and run code","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.","summary":"Goobi viewer trusts the filename in a remote server's Content-Disposition header when downloading external files, so a malicious server can use ../ or absolute paths to write files anywhere Tomcat can write. Writing into the deployed web application directory gives remote code execution as the tomcat user.","severity":"critical","cvss":9.8,"epss":0.01095,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["goobi-viewer","java","package","self-hosted","tomcat"],"not_affected_if":["no-external-file-downloads","versions-before-24.03-or-26.05-plus"],"how_to_check":"Check the deployed Goobi viewer version; affected if it is 24.03 up to but not including 26.05.","fix":"Upgrade Goobi viewer to 26.05 or later.\nIf upgrading is not possible, block the viewer's outbound requests to untrusted hosts until patched.","status":"open","published_at":"2026-10-23T15:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:31:01+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:31:01Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Goobi viewer to 26.05 or later.\nIf upgrading is not possible, block the viewer's outbound requests to untrusted hosts until patched.","reach":"internet","title":"Goobi viewer: remote server headers can write files and run code","impact":"high","summary":"Goobi viewer trusts the filename in a remote server's Content-Disposition header when downloading external files, so a malicious server can use ../ or absolute paths to write files anywhere Tomcat can write. Writing into the deployed web application directory gives remote code execution as the tomcat user.","category":"package","who_cares":["goobi-viewer","java","tomcat","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code as the tomcat user on the server","analyst_note":"","how_to_check":"Check the deployed Goobi viewer version; affected if it is 24.03 up to but not including 26.05.\nunknown","needs_analyst":false,"not_affected_if":["versions-before-24.03-or-26.05-plus","no-external-file-downloads"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000512,"input_tokens":3052,"output_tokens":414,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-46652':14A,17A '24.03':96C '26.05':100C,188C 'absolut':52B,141C 'allow':84C,127C 'anywher':57B 'applic':66B,82C,169C 'arbitrari':156C 'attack':151C 'attacker-control':150C 'browser':93C 'code':11A,70B,174C 'compon':125C 'content':38B,112C,153C 'content-disposit':37B,111C 'control':152C 'cve':12A,15A 'deploy':64B,166C 'destin':104C 'digitis':85C 'direct':119C 'directori':67B,124C,170C 'display':89C 'disposit':39B,113C 'download':42B 'execut':71B,175C 'extern':43B 'externalfilesdownloader.getfilename':101C 'extract':102C 'fetch':136C 'file':8A,44B,56B 'filenam':31B,105C,148C 'give':68B 'goobi':1A,19B,27B,77C 'goobi-view':18B 'header':5A,40B,115C 'host':25B 'http':131C 'issu':182C 'java':21B 'malici':47B,130C 'materi':86C 'os':179C 'packag':22B 'pass':117C 'patch':185C 'path':53B,142C,157C 'path.resolve':121C 'process':162C 'remot':3A,34B,69B,173C 'respons':114C 'run':10A 'self':24B 'self-host':23B 'sequenc':145C 'server':4A,35B,48B,109C,132C 'server-suppli':108C 'strip':123C 'suppli':110C,139C 'target':164C 'tomcat':26B,58B,74B,161C,178C 'travers':144C 'trust':29B 'use':50B 'user':75B,180C 'version':95C,99C,187C 'viewer':2A,20B,28B,78C,135C 'web':65B,81C,92C,168C 'web-appl':167C 'without':122C 'writabl':158C 'write':7A,55B,60B,61B,149C 'yield':172C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46652","severity":null,"published_at":"2026-10-23T15:17:31+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-46652","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46652","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}