CVE-2026-55444 Details
Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.
A Solr injection vulnerability has been identified in the Goobi Viewer web application, specifically in versions prior to 26.05. The issue resides in the legacy RSS servlet (RssResolver, GET /rss/), which improperly validates the q and filterQuery parameters before concatenating them into Solr queries. This lack of validation allows an unauthenticated attacker to inject Solr boolean operators, manipulating the query to include access-restricted records in the generated RSS feed. The vulnerability arises because the q parameter, which forms the main query body, is only wrapped in literal parentheses, while the filterQuery is directly passed as a Solr filter query without proper sanitization.
Users can upgrade to Goobi Viewer version 26.05 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| intranda Goobi viewer | < 26.05 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |