CVE-2026-46651 Details

A vulnerability exists in the Goobi viewer web application, specifically in the goobi-viewer-core component, versions 24.03 through 26.05 prior to 26.05. The issue arises in the DownloadTaskEndpoint WebSocket endpoint, which accepts download requests from unauthenticated users. This vulnerability allows remote attackers to perform Server-Side Request Forgery (SSRF) attacks by sending requests to internal services or metadata endpoints. Additionally, it enables local file inclusion by accessing files readable by the Tomcat process, depending on their file extension.

Users can update to Goobi Viewer version 26.05 or later, where this vulnerability has been patched. For those using Apache httpd, a vhost configuration block can be added to deny access to the WebSocket endpoint. Alternatively, a security constraint can be added in Tomcat's web.xml file to block the WebSocket endpoint.