CVE-2026-46652 | intranda goobi-viewer-core up to 26.4 External Files Downloader ExternalFilesDownloader.getFilename path traversal

October 23, 2026 Yanac

A vulnerability identified as critical has been detected in intranda goobi-viewer-core up to 26.4. The affected element is the function ExternalFilesDownloader.getFilename of the component External Files Downloader. This manipulation causes path traversal.

The identification of this vulnerability is CVE-2026-46652. It is possible to initiate the attack remotely. There is no exploit available.

You should upgrade the affected component.VulDB Recent EntriesRead More