{"schema":"threatline.record/2","record":{"id":"CVE-2026-46652","aliases":["GHSA-r386-2frm-w3v6"],"summary":"Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer","details":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.","categories":["Unclassified"],"product":"goobi-viewer-core","vendor":"intranda","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46652","source_modified_at":"2026-10-23T14:15:46.415Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"goobi-viewer-core","vendor":"intranda","versions":[{"version":">= 24.03, < 26.05","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T14:15:46.415Z","modified_at":"2026-10-23T14:15:46.415Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-46652","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T14:15:46.415Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-r386-2frm-w3v6","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T14:15:46.415Z","content_hash":"c1ddc7aed187bd20bced025c07f7f5fed4b1f23c2619c42440c2eb9f437cb278"}}