# CVE-2026-46652: Goobi viewer path traversal in external file download

Source: https://junglewise.ai/threats/cve-2026-46652-the-goobi-viewer-is-a-web-application-that-allows-digitised  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-46652 · Severity: critical · CVSS 9.8 · Published 2026-10-23

Goobi viewer is a web application that displays digitized materials in browsers. A vulnerability in how it downloads files from external servers allows an attacker controlling a malicious server to write arbitrary files to the server's filesystem, potentially achieving remote code execution with the privileges of the Tomcat web server process.

Technologies: [Intranda Goobi viewer](https://junglewise.ai/threats/technologies/goobi-viewer). Vendors: [Intranda](https://junglewise.ai/threats/vendors/intranda).

## Quick answers

**Is CVE-2026-46652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46652 being exploited in the wild.

**How severe is CVE-2026-46652?** Critical severity, with a CVSS score of 9.8, published 23 October 2026.

**Which products and versions are affected?** Intranda Goobi viewer 24.03 to before 26.05.

**Is there a fix for CVE-2026-46652?** Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46652 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-46652?** Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.05

## Technical details

The ExternalFilesDownloader.getFilename() method extracts the destination filename directly from HTTP Content-Disposition response headers and passes it to Path.resolve() without sanitization, allowing directory traversal sequences (../) or absolute paths. An attacker running a malicious HTTP server that the Goobi viewer fetches from can exploit this to write files to arbitrary writable locations. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user.

## Affected products

- intranda Goobi viewer 24.03 to before 26.05

## Timeline

- 2026-10-23: disclosed
- 2026-05-18: patched: Fix commit date indicates patch was developed before public disclosure

## References

- [https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5](https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5)
- [https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05](https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05)

## Related threats

- [Goobi viewer reflected XSS in IIIF Auth endpoints](https://junglewise.ai/threats/cve-2026-55486-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in spatial search endpoint](https://junglewise.ai/threats/cve-2026-55465-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass in OpenID token validation](https://junglewise.ai/threats/cve-2026-55459-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass via empty API token](https://junglewise.ai/threats/cve-2026-55457-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in RSS servlet](https://junglewise.ai/threats/cve-2026-55444-the-goobi-viewer-is-a-web-application-that-allows-digitised)