CVE-2026-46652
- Source
- https://cve.org/CVERecord?id=CVE-2026-46652
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46652.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-46652
- Aliases
-
- GHSA-r386-2frm-w3v6
- Published
- 2026-10-23T14:15:46Z
- Modified
- 2026-11-01T07:03:43Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
- Details
-
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-22", "CWE-73" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46652.json" }- References
-
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46652.json
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-r386-2frm-w3v6
- https://nvd.nist.gov/vuln/detail/CVE-2026-46652
- https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5
Affected packages
Git / github.com/intranda/goobi-viewer-core
Affected ranges
- Type
- GIT
- Repo
- https://github.com/intranda/goobi-viewer-core
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "24.03" }, { "fixed": "26.05" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "5281245708447ae3419cb42492fbb8af731a2ce5" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v26.05", "range": [ { "fixed": "7e5e9de18c572c7b96f80efe01254bf08dc4cdb4" } ], "source": "REFERENCES_TAG" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46652.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "76737708323490671307672657125259109568",
"length": 491
},
"id": "CVE-2026-46652-0dd6f31d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/viewer/ViewManager.java",
"function": "loadExternalResourceUrls"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "106402485554899524395314101304609415349",
"length": 1014
},
"id": "CVE-2026-46652-192dc2d1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/files/external/ExternalFilesDownloader.java",
"function": "downloadHttpResource"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "299465923679625129777857620543158450320",
"length": 184
},
"id": "CVE-2026-46652-27a295dd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/viewer/ViewManager.java",
"function": "getExternalResourceUrls"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "15972731808254145666261176205669785459",
"length": 2933
},
"id": "CVE-2026-46652-2ad86a12",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java",
"function": "getAdvancedSearchSelectItems"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "55373763876506741160533861096182947701",
"length": 395
},
"id": "CVE-2026-46652-31934e0a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/files/external/ExternalFilesDownloader.java",
"function": "downloadExternalFiles"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "214082505072598991716962068944808016831",
"length": 460
},
"id": "CVE-2026-46652-38938516",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/controller/Configuration.java",
"function": "getExternalResourceUrlTemplates"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293943419837386175782308880630292377328",
"170127000326944715759514306120173437552",
"223072314872435556758862870822129730388",
"184713866145576581573500654664532882358",
"237588089203428832734919670992173305409",
"280990611135733430789396002312530922372",
"24011410402069477058498461939093920262",
"243679154761233145932008628234109855606",
"21245126937807009457669850870559185657",
"157573805690410280521963065924689943951",
"49299172231513956195727309028396980246",
"249794867519244567083176728280977870199",
"71331133885813258577251813447387200972",
"231280190624403314206933099108260677099",
"131064644070503162456003862872168843296",
"228717970448403275474455688186333628072",
"147229437546344567055115541779032048353",
"296771280783092075493187168226162854698",
"120686590177198208650842153671343843197",
"185110271319730517681325665849978046676",
"133072927174758095098837509638475082729",
"106915568864856288436707486586529388843",
"160461748305160759432425790653772593920",
"317668832181560233029467657143735579550",
"73682667438275365798270958473607512942",
"249449434883737352069413629640348278192",
"195647711537184443325539778426838681880",
"257419450339920369642547725144123517283",
"112254453685341924447530792146304337784",
"200506628299564351230936520852436132030",
"99422724347327295676833174058837105043",
"141225596712123407189091063186974358645",
"281192752199487692721550185112564389005",
"194840973750847596253923718843247966422",
"336380174445271318603843347024206517237",
"96952457555478317003593573357220284563",
"288939005615045911177043736404399404541",
"328674136467211459900128018005816102742",
"75851200508167515578606821188405267014",
"230110937255770512631639417010960709132",
"243367955632336005134513142238333853843",
"253728686788632627169401501763323725722",
"28196279546092511104474535655606889983",
"240985082911872732109250870253022523110",
"7405899224190688798808783959628142002",
"91368197618688457157980371544354479789",
"158697872569671941832991527465912955348",
"305106691200856417832257034142201370878",
"289336218389088023408326258965270312936",
"32131413311487982245812841291902270705",
"133528045941229369766499737505022324454",
"118600259359074066127455075675860467005",
"277131013592039677111080227322086714878",
"12132793595964136568255504321677124068",
"237513637503532782536650314870439478037",
"203609570456295320982548574336354293445",
"51906176174227463930981612168786621659",
"198425266314817376550601752740401743673",
"239541424654697691920923576302018587810",
"4477980581229884955895429889103133623",
"65554406765763519915522339427629544886"
],
"threshold": 0.9
},
"id": "CVE-2026-46652-46a7ca97",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"228290816233981740507221904153784625183",
"316392729770960068137958280905167349177",
"20252846280030098481294537028674119849",
"265696207954840649163536196987436350714"
],
"threshold": 0.9
},
"id": "CVE-2026-46652-481ae854",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/controller/Configuration.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "80050939882449251482287647859133592846",
"length": 292
},
"id": "CVE-2026-46652-4913ceab",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/files/external/ExternalFilesDownloader.java",
"function": "checkHttpResource"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172036081619728264536544836022424920576",
"206262415591075143195014707826825852740",
"160032195307483152179728616949622498999",
"282161237875046225444754169489884877002",
"132108408661853093970109855011338221981",
"28478075218801398287275379985148282232",
"284753550502011747695405436594164909886",
"176908227494880128665329177559840609716",
"153675016924976758166007005213202671482",
"288690527470119013389424754516090411753",
"205098214255486405439562099235035222167",
"148954859319084339565663033661081729317",
"20465985720902283124755590941999225388",
"55142651690219658327487283770170577477",
"214425688006711146829706937447001439791",
"260879421169726657963994483969978910922",
"109739466360607804678814684134440234150",
"36412447194584549571086838493076223541",
"173701140012002931983719472796449051759",
"262805346583614128346995888780065571178",
"98826498306568040237426355090843674411"
],
"threshold": 0.9
},
"id": "CVE-2026-46652-6c70c086",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/DownloadTaskEndpoint.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "50489312385463977554948546991265001746",
"length": 997
},
"id": "CVE-2026-46652-985199da",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/DownloadTaskEndpoint.java",
"function": "onMessage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"46878440448091772417511226788801768367",
"76754536853848593023514482015793192076",
"75971827331914051826655070387523342044",
"49899328514912669300887188423938086948",
"232180690905111500886237000712207656747",
"56926609594750345628030697665364727179",
"169253853054120947418774628309155383395",
"331954715067789150434276552221668545994",
"325532051219885859897221313823114111538",
"84567926099992410006983589717489229599",
"134437330219077746911136874912815776816",
"333127822100339668159167389501121316993",
"98187646478974661766651679420399300755",
"126417909114650127219113800004230261918",
"6044296525230556214003668201947837253",
"283268639007526871573710841073445071606",
"141190670289558489065592614168993891976",
"315356759156828604957583358939411599787",
"288717453621594439387056226257504258455",
"243504218000033026319846544006683645871",
"339694707936292365402825273492007272446",
"218816235474873895594908710775382576107",
"150825795303050326441476488127129665465",
"84865560178765520536914361739171979211",
"312939871089883545174542364170622786530",
"23665400425324184739205394500239981107",
"284027730988393224976989038745450934518"
],
"threshold": 0.9
},
"id": "CVE-2026-46652-ac43f516",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/viewer/ViewManager.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"58534034612165146162516628574392220547",
"279058887333202353401553292302684944662",
"4755541367937704021289046467018827467",
"310708302149679191361245907308485601334",
"80698763899084003966887548490038437237",
"163257403754885274667512177220676599379",
"203131200185598794150515540360321653521",
"79385461869888998336632050043295060649",
"199015985062901047016818062987179482872",
"244699249134842210378916973202631529613",
"282037970412512135824075459072120099488",
"123846567515973387315777774546812853984",
"65164806190641594165264081285911982077",
"312635219160953768652662386347201063590",
"331672067817297614022487545413179841772",
"156862111356747941235766827548492589645",
"60011013475405092931108765700974046330",
"327420071189808858919896565590037419341",
"202053132523294565985670804179037101865",
"174300228488637910881312402971948381635",
"194349314531069912836852025720825800647",
"117614238786495092823934560625373704235",
"113770494852118217936413161455866389220",
"116778411354805563602337080123080689793",
"60940997672715323076559174651983499178",
"129131245367182511362551760541614646219",
"140517186258675304361107442287295058773",
"142575938046256148414713357361065742224",
"194697294559222193623634127526123683568",
"83770756804738936927580466448997134349",
"304455828019382186366194270644843119607",
"310597936761264251478804897717862830603",
"92119391774427986708360176948865716248",
"68869387031170061513197020380642396220",
"219448375093103482120369618497838122333",
"311552702258616960843468296464179676049",
"221113473640010856635408088843736880515",
"284448017566455639517316028890362438876",
"226584991637411042824917509296044670870",
"29092110712191111270582187327357643561",
"125286447263770015532608310606991253652",
"282450949284237182320717096645478644261",
"57738360317354562657242151951645951480",
"317792037785699978829162996787129419959",
"39736829627435811709421939997217670728",
"165429691163410291253507887426159205126",
"156127724874891383902504403643214712230",
"222208825463063098269430493735200565449",
"213601858264940852465961656875343396614"
],
"threshold": 0.9
},
"id": "CVE-2026-46652-bff8ff9d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/files/external/ExternalFilesDownloader.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "35593499378208335899006932559420075394",
"length": 511
},
"id": "CVE-2026-46652-ca5fdfa7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/files/external/ExternalFilesDownloader.java",
"function": "resourceExists"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"255085158912242990149154061937887950366",
"334794444803940586033471419990234207055",
"195028072747198060985453424721312375518",
"133385654581509549223818728611932846293",
"46394507573639897272812200072770341846",
"286169140829845435556544899460533511296"
],
"threshold": 0.9
},
"id": "CVE-2026-46652-ebc9f4b7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/model/files/external/ExternalFilesDownloaderTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "202694403147738395954402808185936590360",
"length": 753
},
"id": "CVE-2026-46652-f5e729cb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/model/files/external/ExternalFilesDownloader.java",
"function": "getFilename"
}
}
]
vanir_signatures_modified
"2026-11-01T07:03:43Z"