Goobi Viewer EUVD-2026-109084

Exploitation requires reaching a Goobi viewer core endpoint that forwards user-supplied query strings through SolrTools.cleanUpQuery() to Solr (the shared sanitizer, so any such endpoint qualifies), on versions >=23.03 and before 26.05 - the double-brace {{!...}} bypass specifically applies from v23.10 where the greedy \{(.+)\} regex was introduced, while a bare-!join rewrap path exists from v23.03. No authentication, user interaction, or non-default configuration is needed (AV:N/AC:L/PR:N/UI:N); the attacker only needs to wrap a Solr local parameter in a second pair of curly braces. The key LIMITING factor on impact is that the injected local params cannot directly return access-restricted content - the outer access-condition filter still constrains returned documents - so exploitation is confined to structural inference (which open-access records have access-restricted sub-documents) rather than disclosure of the restricted content itself.

The signals point to a genuine but modest-severity issue rather than an urgent priority. The supplied CVSS is 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N): network-reachable, low complexity, unauthenticated (PR:N), but only low confidentiality impact and no integrity or availability impact. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit is identified at time of analysis - the only references are the vendor GHSA advisory and patch commits. The vuln.today decision label is 'this_month', consistent with a medium-severity, non-emergency item. A full SSVC decision (automatable / technical-impact fields) is not supplied. The most important nuance, stated explicitly by the vendor advisory, is that the flaw does NOT by itself disclose access-restricted content: the outer access-condition filter still applies to returned documents, so the realistic impact is limited to inferring structural facts (e.g. which open-access top-level records have access-restricted sub-documents). This tempers the unauthenticated-network vector - real-world risk is low-to-medium information leakage, not a high-impact breach. Missing data to note: no EPSS, no KEV, no independent SSVC exploitation status.

An unauthenticated attacker submits a crafted search query to any Goobi viewer endpoint that routes input through SolrTools.cleanUpQuery(), wrapping a Solr local parameter in a second pair of curly braces (e.g. {{!join from=PI_TOPSTRUCT to=PI}}) so the sanitizer strips only the outer braces and forwards the intact inner {!...} to Solr. By injecting block-join, graph-traversal or function-query local params the attacker can infer which open-access top-level records have access-restricted sub-documents. No public exploit is identified, though the patch commit includes test cases that demonstrate the double-brace bypass concretely.