{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/goobi/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:goobi:goobi_viewer:24.03:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-46652"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-46652\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Goobi viewer (24.03 - 26.04)"],"_cs_severities":["critical"],"_cs_tags":["path-traversal","rce","web-application","cve-2026-46652"],"_cs_type":"advisory","_cs_vendors":["Goobi"],"content_html":"\u003cp\u003eGoobi viewer versions 24.03 through 26.04 are vulnerable to path traversal via the \u003ccode\u003eExternalFilesDownloader.getFilename()\u003c/code\u003e component. The application fails to sanitize the filename extracted from the \u003ccode\u003eContent-Disposition\u003c/code\u003e header provided by an external HTTP server, passing it directly to \u003ccode\u003ePath.resolve()\u003c/code\u003e. An attacker controlling an external resource can supply absolute paths or directory traversal sequences (e.g., ../) to write files to arbitrary locations writable by the Tomcat process. Exploitation targeting the web application directory results in remote code execution as the Tomcat user. This vulnerability is addressed in version 26.05.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file write on the host filesystem. If the application environment allows, an attacker can achieve remote code execution by overwriting web application files or placing scripts in executable directories.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Goobi viewer to version 26.05 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is delayed, restrict outbound network access for the server to prevent fetching content from unauthorized or untrusted remote HTTP servers.\u003c/li\u003e\n\u003cli\u003eReview server-side file access logs for unexpected writes occurring in the web application root or configuration directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T16:38:36Z","date_published":"2026-10-23T15:43:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-goobi-viewer-traversal/","summary":"Goobi viewer versions 24.03 to 26.04 contain a path traversal vulnerability allowing remote code execution via a malicious Content-Disposition header in external file downloads.","title":"Goobi viewer: Arbitrary file write and remote code execution (CVE-2026-46652)","url":"https://feed.craftedsignal.io/briefs/2026-10-goobi-viewer-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Goobi","version":"https://jsonfeed.org/version/1.1"}