CVE-2026-55444— Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
Quick assessment
Affected
intranda goobi-viewer-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Goobi 查看器是一款 Web 应用程序，用于在浏览器中展示数字化资源。在 26.05 版本之前，其遗留的 RSS Servlet（RssResolver，路径为 GET /rss/）会接收 q 和 filterQuery 参数，并在未进行任何验证的情况下将它们拼接成 Solr 查询语句。该 Servlet 早于 REST API 层开发，因此缺少 GET /api/v1/records/rss 接口中所具备的输入验证机制。其中，q 参数构成查询主体（仅用字面括号包裹），而 filterQuery 参数则直接作为
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| intranda | goobi-viewer-core | < 26.05 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55444
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
Source: CVE Program / CVE List V5
Vulnerability Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| intranda | goobi-viewer-core | < 26.05 | - |
|
II. Public POCs for CVE-2026-55444
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55444
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55444 (2)
Vendor Advisories for CVE-2026-55444 (1)
Vendor Pages for CVE-2026-55444 (1)
-
🔗 Release Release v26.05 · intranda/goobi-viewer-core · GitHub x_refsource_MISC
Same Patch Batch · intranda · 2026-10-23 · 11 CVEs total
| CVE-2026-46651 | 9.8 CRITICAL | Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi |
| CVE-2026-46652 | 9.8 CRITICAL | Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables re |
| CVE-2026-55486 | 9.3 CRITICAL | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected |
| CVE-2026-55457 | 7.4 HIGH | Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorizati |
| CVE-2026-55459 | 7.4 HIGH | Goobi viewer: OpenID JWT audience not enforced by the verifier |
| CVE-2026-46347 | 6.8 MEDIUM | Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Rese |
| CVE-2026-55463 | 6.5 MEDIUM | Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation |
| CVE-2026-46346 | 6.5 MEDIUM | Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset |
| CVE-2026-55442 | 5.3 MEDIUM | Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection |
| CVE-2026-55465 | 5.3 MEDIUM | Goobi viewer: Solr injection via unvalidated region parameter in spatial search |
IV. Related Vulnerabilities
Same product: goobi-viewer-core
-
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — C -
CVE-2026-55465
Goobi viewer: Solr injection via unvalidated region paramete -
CVE-2026-55463
Goobi viewer: WebSocket endpoints lack server-side authentic -
CVE-2026-55459
Goobi viewer: OpenID JWT audience not enforced by the verifi -
CVE-2026-55457
Goobi viewer: Empty webapi.authorization.token default permi
Same vendor: intranda
-
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — C -
CVE-2026-55465
Goobi viewer: Solr injection via unvalidated region paramete -
CVE-2026-55463
Goobi viewer: WebSocket endpoints lack server-side authentic -
CVE-2026-55459
Goobi viewer: OpenID JWT audience not enforced by the verifi -
CVE-2026-55457
Goobi viewer: Empty webapi.authorization.token default permi
Same weakness: CWE-20
-
CVE-2026-115883
LangGraph: Namespace labels containing `.` reach other names -
CVE-2026-55442
Goobi viewer: cleanUpQuery double-brace bypass allows arbitr -
CVE-2026-115479
baserCMS: Mail-form auto-replies accept multiple visitor-con -
CVE-2026-57210
Heimdall: IP Spoofing via Unvalidated Forwarding Headers -
CVE-2026-57209
Heimdall: Forwarded Header Injection via Unsanitized Host He
V. Comments for CVE-2026-55444
No comments yet