Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 26.05
- Public exploit
- None on Exploit-DB
Summary
Goobi viewer, a web application for displaying digitised material in a browser, is affected by this vulnerability. An attacker controlling a remote HTTP server that the viewer downloads from could write files to arbitrary locations the Tomcat process can access, potentially achieving remote code execution as the tomcat user.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
Affected versions
- intranda goobi-viewer-core
From 24.03 · fixed in 26.05