Vendor
Goobi viewer versions 24.03 to 26.04 contain a path traversal vulnerability allowing remote code execution via a malicious Content-Disposition header in external file downloads.