Executive Summary
CVE-2026-46652 is a critical path traversal vulnerability in goobi-viewer-core. The method ExternalFilesDownloader.getFilename() takes the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. A malicious or compromised remote server can therefore steer where the downloaded file is written.
CVSS Score: 9.8 (Critical)
Public analyses describe the impact as arbitrary file write that can lead to remote code execution when the file lands in an executable or auto-loaded location. It was published on 2026-10-23 and is fixed in version 26.05. No public exploit was listed at the time of writing. Note that VulDB words the affected range as "up to 26.4", while the CVE text says 24.03 up to but not including 26.05; treat both as the same release line and upgrade to 26.05.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-46652 |
| CVSS Score | 9.8 (Critical) |
| Weakness | Path traversal (CWE-22) |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Affected Component | ExternalFilesDownloader.getFilename() |
| Patch Available | Yes — goobi-viewer-core 26.05 |
| Known Exploited | Not reported |
Affected Products
| Product | Affected Versions | Fixed Version |
|---|---|---|
| intranda goobi-viewer-core | 24.03 up to (not including) 26.05 | 26.05 |
Technical Analysis
When the viewer downloads an external file, it trusts the filename advertised in the HTTP Content-Disposition header. A value containing sequences such as ../ is resolved relative to the download directory, so the final path can escape it. The attacker only needs to control the server the viewer fetches from, or to intercept that response.
This flaw is closely related to CVE-2026-46651, which lets unauthenticated users trigger server-side downloads. Combined, an anonymous attacker could point the viewer at an attacker-controlled server and then write a file of their choosing on the host. This chaining is a reasoned inference from the two advisories, not a confirmed attack.
Impact Assessment
| Impact Area | Description |
|---|---|
| Arbitrary File Write | Files can be placed outside the intended download directory |
| Code Execution | Overwriting scripts, web content, or configuration can lead to RCE |
| Integrity | Application or collection data can be tampered with |
| Availability | Critical files can be overwritten, breaking the service |
Immediate Remediation
- Upgrade goobi-viewer-core to 26.05 or later.
- Apply the mitigation for CVE-2026-46651 as well, since the two issues share the same release fix.
- Run the application with a least-privilege account and a read-only filesystem wherever possible.
- Restrict outbound connections from the viewer host to trusted sources.
Detection Indicators
| Indicator | Description |
|---|---|
| Files created outside the viewer's download directory by the application process | Exploitation |
| Outbound fetches from the viewer to unfamiliar hosts | Attacker-controlled source |
| Unexpected changes to scripts, JSPs, or configuration files | Post-exploitation |