Goobi Viewer Path Traversal Arbitrary File Write Vulnerability

The Goobi viewer is a web application that displays digitised material in a browser. From version 24.03 to before 26.05, it contains a path traversal flaw in ExternalFilesDownloader.getFilename().

The method extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. A malicious HTTP server the viewer fetches from can supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process.

• Affected versions: 24.03 to before 26.05.
• Impact: arbitrary file write; targeting the deployed web-application directory yields remote code execution as the tomcat OS user.

The issue has been patched in version 26.05.