CVE-2026-46652

Summary

The Goobi viewer's ExternalFilesDownloader.getFilename() method extracts filenames from untrusted Content-Disposition headers without sanitizing directory traversal sequences, allowing an attacker-controlled HTTP server to write arbitrary files (including webshells) to the Tomcat process's writable paths, leading to remote code execution.

Exploitability

Exploitation requires control of a server that the vulnerable application fetches from and the ability to serve a malicious Content-Disposition header with path traversal sequences; no authentication or user interaction is needed.

Blast radius

Successful exploitation grants remote code execution as the Tomcat OS user, potentially compromising the entire host and any downstream systems accessible to that account.

Detection

Defenders should monitor for unexpected file creation or modification in the web-application directory (e.g., .jsp, .war, or other webshell-named files) and for outbound HTTP requests to untrusted external servers during file-download operations; no specific log line or network signature is reliably derivable from the description.

Prioritized remediation

Upgrade to Goobi viewer version 26.05 or later, which patches the path traversal vulnerability in ExternalFilesDownloader.getFilename().

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.