Goobi viewer CVE-2026-46651

No authentication required - the /tasks/download/monitor.socket WebSocket endpoint in goobi-viewer-core accepts download requests from unauthenticated users, enabling remote exploitation against default configurations of affected versions (24.03 through 26.04). Exploitation requires that the endpoint is network-reachable (the vendor's Apache httpd 'Require all denied' LocationMatch or a Tomcat web.xml auth-constraint on that URL pattern blocks it, and would limit exposure). The concrete impact depends on what the attacker can reach: SSRF value hinges on reachable internal hosts such as the local Solr instance or cloud instance-metadata endpoints; local file disclosure is limited to files readable by the Tomcat process whose extension is in the application's allowed list (other extensions are written to disk but not retrievable); the DoS requires the reachable Solr Core Admin UNLOAD action.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is corroborated by the vendor GHSA advisory: the DownloadTaskEndpoint WebSocket (/tasks/download/monitor.socket) is reachable over the network and explicitly accepts requests from unauthenticated users (CWE-306), so the PR:N claim is confirmed rather than inferred. The vulnerability chains into unauthenticated SSRF (CWE-918), arbitrary local file inclusion (CWE-552/CWE-22), and a destructive Solr Core 'UNLOAD' DoS, which supports the vuln.today 'act_now' decision label. Signals partially conflict on exploitation evidence: no EPSS score was supplied (exploitation probability unknown) and KEV status was not provided (treat as not confirmed actively exploited), while SSVC-style technical impact is clearly total (confidentiality via internal/file/Solr metadata reads, availability via index destruction). The supplied references are the vendor advisory and the two fix commits plus the v26.05 release - these are remediation artifacts, not an exploit, so there is no public exploit identified at time of analysis. Net: the low-complexity, unauthenticated, network-facing nature combined with vendor-confirmed SSRF/LFI/DoS justifies urgent patching even in the absence of an EPSS/KEV signal; the main real-world moderator is the product's niche deployment footprint.

An unauthenticated remote attacker opens a WebSocket connection to /tasks/download/monitor.socket and submits a download request pointing at an internal URL - for example the co-located Solr instance or a cloud instance-metadata endpoint - and reads back the response, harvesting all indexed document metadata without access-condition filtering or stealing cloud credentials. The same endpoint can be pointed at local files (extensions in the allowed list) for file disclosure, or used to call Solr's Core Admin UNLOAD action to destroy the index and take the viewer fully offline. No public exploit was identified at time of analysis; the only published artifacts are the advisory and fix commits.