CVE-2026-46652 intranda CVE debrief

Who should care

Defenders responsible for Goobi viewer deployments, particularly those using versions between 24.03 and 26.05, should assess exposure and apply patches to prevent remote code execution. This includes reviewing and updating inventory to ensure accurate tracking of affected versions, implementing monitoring to detect potential exploitation attempts, and reviewing compensating controls for exposed systems.

Why it matters

Defenders should prioritize verifying exposure and applying patches for Goobi viewer versions between 24.03 and 26.05 to prevent remote code execution.

• Remote code execution as the tomcat OS user when targeting the deployed web-application directory.
• Potential for writing attacker-controlled content to an arbitrary path writable by the Tomcat process.
• Need for verification of affected versions and application of patches.

Technical summary

The Goobi viewer, a web application for displaying digitized material, is vulnerable to a path traversal attack via the HTTP Content-Disposition header in ExternalFilesDownloader. This allows for remote code execution in versions 24.03 to before 26.05. The vulnerability enables malicious HTTP servers to supply absolute paths or ../ traversal sequences as filenames, writing attacker-controlled content to arbitrary paths writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Goobi viewer versions between 24.03 and 26.05.

Recommended defensive actions

• Verify if Goobi viewer versions between 24.03 and 26.05 are in use and apply patches to prevent remote code execution.
• Review and update inventory to ensure accurate tracking of affected versions.
• Implement monitoring to detect potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the path traversal vulnerability in ExternalFilesDownloader, which allows remote code execution in Goobi viewer versions 24.03 to before 26.05. The vulnerability is caused by the application's failure to strip directory components from the filename extracted from the Content-Disposition response header. This allows attackers to write content to arbitrary paths, potentially leading to remote code execution. Defenders should verify exposure and apply patches to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.