Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

goobi-viewer-core — Vulnerabilities & Security Advisories 16

All 16 CVE vulnerabilities found in goobi-viewer-core, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses affecting the goobi-viewer-core product developed by the SUB Göttingen vendor, specifically categorized under the software vulnerability tag. The collection encompasses a broad spectrum of reported issues including remote code execution, cross-site scripting, and improper input validation flaws identified in the application from its initial release through the current stable version. Visitors can utilize this resource to track the vendor's historical security advisories, understand the specific characteristics of the weakness classes prevalent in digital library viewing tools, or review the complete vulnerability history associated with the goobi-viewer-core software stack. The data presented here is compiled from public security databases and vendor disclosures to provide a centralized view of the product's security posture without relying on marketing language or promotional content. By examining the trends in reported defects over time, security professionals and administrators can better assess the risk landscape and prioritize necessary remediation efforts for their deployments. This aggregation serves as a factual reference point for incident response teams and auditors requiring a comprehensive overview of past and present security gaps within the goobi-viewer-core ecosystem. All entries are verified against authoritative sources to ensure accuracy and relevance for the target audience.

Vendor: intranda

CVE ID Title CVSS Severity Published
CVE-2026-55486 Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS CWE-79 9.3 Critical 2026-10-23
CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search CWE-89 5.3 Medium 2026-10-23
CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation CWE-306 6.5 Medium 2026-10-23
CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier CWE-287 7.4 High 2026-10-23
CVE-2026-55457 Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass CWE-287 7.4 High 2026-10-23
CVE-2026-55444 Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters CWE-20 5.3 Medium 2026-10-23
CVE-2026-46652 Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer CWE-22 9.8 Critical 2026-10-23
CVE-2026-46651 Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer CWE-306 9.8 Critical 2026-10-23
CVE-2026-46347 Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset CWE-330 6.8 Medium 2026-10-23
CVE-2026-46346 Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset CWE-330 6.5 Medium 2026-10-23
CVE-2026-55442 Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection CWE-20 5.3 Medium 2026-10-23
CVE-2026-45083 Goobi viewer: Unauthenticated Solr Streaming Expression Proxy CWE-306 9.8 Critical 2026-05-27
CVE-2023-29016 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames CWE-79 6.1 Medium 2023-04-06
CVE-2023-29015 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments CWE-79 6.1 Medium 2023-04-06
CVE-2023-29014 Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter CWE-79 6.1 Medium 2023-04-06
CVE-2020-15124 Path traversal in Goobi viewer Core CWE-22 9.6 Critical 2020-07-22

All 16 known CVE vulnerabilities affecting goobi-viewer-core with full Chinese analysis, references, and POCs where available.