Advisories · Technology

intranda goobi-viewer-core.

Every CVE that names intranda goobi-viewer-core among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-55486 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
- intranda goobi-viewer-core
- Cross-site scripting (XSS)
- Other injection
Not analysed yet 23 Oct 2026
CVE-2026-55465 CVE record

CVSS 5.3 Medium

Goobi viewer: Solr injection via unvalidated region parameter in spatial search
- intranda goobi-viewer-core
- SQL injection
- Other injection
Not analysed yet 23 Oct 2026
CVE-2026-55463 CVE record

CVSS 6.5 Medium

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation
- intranda goobi-viewer-core
- Authentication bypass
- Broken access control
Not analysed yet 23 Oct 2026
CVE-2026-55459 CVE record

CVSS 7.4 High

Goobi viewer: OpenID JWT audience not enforced by the verifier
- intranda goobi-viewer-core
- Authentication bypass
- CWE-345
Not analysed yet 23 Oct 2026
CVE-2026-55457 CVE record

CVSS 7.4 High

Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass
- intranda goobi-viewer-core
- Authentication bypass
- CWE-1392
Not analysed yet 23 Oct 2026
CVE-2026-55444 CVE record

CVSS 5.3 Medium

Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
- intranda goobi-viewer-core
- SQL injection
- Other injection
Not analysed yet 23 Oct 2026
CVE-2026-46652 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
- intranda goobi-viewer-core
- Path traversal
Not analysed yet 23 Oct 2026
CVE-2026-46651 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
- intranda goobi-viewer-core
- Authentication bypass
- Information disclosure
Not analysed yet 23 Oct 2026
CVE-2026-46347 CVE record

CVSS 6.8 Medium

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset
- intranda goobi-viewer-core
- Weak cryptography or TLS
- CWE-340
Not analysed yet 23 Oct 2026
CVE-2026-46346 CVE record

CVSS 6.5 Medium

Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
- intranda goobi-viewer-core
- Weak cryptography or TLS
- CWE-340
Not analysed yet 23 Oct 2026
CVE-2026-55442 CVE record

CVSS 5.3 Medium

Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection
- intranda goobi-viewer-core
- CWE-20
- CWE-116
Not analysed yet 23 Oct 2026
CVE-2020-15124 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Path traversal in Goobi viewer Core
- intranda goobi-viewer-core
- Path traversal
Not analysed yet 22 Jul 2020