CVE-2020-15124: Path Traversal in Goobi Viewer Core

The path traversal vulnerability in Goobi Viewer Core allows an attacker to manipulate file paths within the application, bypassing intended access controls. By crafting malicious requests, an attacker can potentially read files located outside of the intended web root directory. The scope of access is limited to files accessible by the application server user (e.g., Tomcat), but this could still include configuration files, database credentials, or other sensitive information. While not directly leading to remote code execution, the disclosure of such data could be leveraged for further attacks, such as privilege escalation or data breaches.

1. Reserved2020-06-25
2. Published2020-07-22
3. Modified2024-08-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2020-15124 is to immediately upgrade Goobi Viewer Core to version 4.8.3 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting file access permissions for the application server user to the absolute minimum required. Additionally, configure a Web Application Firewall (WAF) to filter requests containing suspicious path traversal patterns (e.g., '../'). Regularly review application logs for any unusual file access attempts. After upgrading, confirm the fix by attempting a path traversal attack and verifying that access is denied.