anonhaven

CVE-2026-55444

MEDIUM CVSS 3.1: 5.3 EPSS 0.43%
Updated Oct 23, 2026
Parameter Value
CVSS 5.3 (MEDIUM)
Fixed In 26.05
Type CWE-943, CWE-20 (Improper Input Validation), CWE-89 (SQL Injection)
Public PoC No

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq.

An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-943
CWE-20 Improper Input Validation
CWE-89 SQL Injection

References 4

https://github.com/intranda/goobi-viewer-core/commit/e8d987f8478b86559ef3ea236b…
security-advisories@github.com
https://github.com/intranda/goobi-viewer-core/commit/fcdae14b06e99f3320a02d45a6…
security-advisories@github.com
https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
security-advisories@github.com
https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-763m-wjm…
security-advisories@github.com
Share Post Share Share Share