The vulnerability resides in the ExternalFilesDownloader component of Goobi viewer core, where the filename supplied in an HTTP Content-Disposition header is forwarded directly to Path.resolve() without removing directory traversal components. This allows an attacker to supply a filename containing absolute paths or '../' sequences, causing attacker-controlled content to be written to any path the Tomcat process can reach. The result is that the attacker can place a malicious executable or script in the deployed web‑application directory, achieving remote code execution as the Tomcat OS user. The weakness is a classic path traversal flaw, reflected in CWE-22 and CWE-73.

The flaw affects intranda Goobi viewer core versions 24.03 through the release just before 26.05. The patch that addresses the flaw is included in Goobi viewer core v26.05 and newer.

The listed CVSS score of 9.8 indicates critical severity. The EPSS score of 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector can be inferred as remote, requiring an attacker to control the HTTP server that the viewer contacts to supply a malicious Content‑Disposition header. Given the severe impact and that exploitation only requires control of the HTTP server, the overall risk to deployments remains high, yet the low EPSS score indicates that actual exploitation is unlikely.