Goobi viewer: Arbitrary file write and remote code execution (CVE-2026-46652)

Goobi viewer versions 24.03 through 26.04 are vulnerable to path traversal via the ExternalFilesDownloader.getFilename() component. The application fails to sanitize the filename extracted from the Content-Disposition header provided by an external HTTP server, passing it directly to Path.resolve(). An attacker controlling an external resource can supply absolute paths or directory traversal sequences (e.g., ../) to write files to arbitrary locations writable by the Tomcat process. Exploitation targeting the web application directory results in remote code execution as the Tomcat user. This vulnerability is addressed in version 26.05.

Impact

Successful exploitation allows for arbitrary file write on the host filesystem. If the application environment allows, an attacker can achieve remote code execution by overwriting web application files or placing scripts in executable directories.

Recommendation

• Update Goobi viewer to version 26.05 or later immediately.
• If patching is delayed, restrict outbound network access for the server to prevent fetching content from unauthorized or untrusted remote HTTP servers.
• Review server-side file access logs for unexpected writes occurring in the web application root or configuration directories.