anonhaven

CVE-2026-55442

MEDIUM CVSS 3.1: 5.3 EPSS 0.45%
Updated Oct 23, 2026
Parameter Value
CVSS 5.3 (MEDIUM)
Affected Versions before 26.05
Fixed In 26.05
Type CWE-116 (Improper Encoding or Escaping of Output), CWE-20 (Improper Input Validation)
Public PoC No

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded.

The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy \{(.+)\} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-116 Improper Encoding or Escaping of Output
CWE-20 Improper Input Validation

References 4

https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98…
security-advisories@github.com
https://github.com/intranda/goobi-viewer-core/commit/5a59ffa5d76169a4ad3cc39602…
security-advisories@github.com
https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
security-advisories@github.com
https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2r24-qxp…
security-advisories@github.com
Share Post Share Share Share