Intranda
Monthly
Reflected cross-site scripting in the IIIF Auth 2.0 endpoints auth/login and auth/token of Goobi Viewer Core (maven io.goobi.viewer:viewer-core) from version 25.08 up to, but not including, 26.05 allows remote unauthenticated attackers to execute JavaScript in a victim's viewer origin, scoring CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). The unvalidated origin query parameter is reflected into the Content-Security-Policy frame-ancestors response header and into an HTML body as a single-quoted JavaScript postMessage argument, and because the attacker controls both the login and token calls that initiate the flow, the payload is reachable without any pre-existing trust relationship. Exploitation requires a victim to be induced to open a crafted request (UI:R); the vendor notes a default install remains exploitable via top-level navigation because the shipped reverse-proxy configuration sets no script-src Content-Security-Policy, while the shipped X-Frame-Options: DENY and frame-ancestors 'self' block only the stealthier cross-origin iframe-delivery variant and the CSP-header malformation. No public exploit code was identified at time of analysis, but the priority decision label is act_now and the vendor has released a patch.
OpenID Connect login in Goobi viewer 25.01 through 26.04 validates the JWT audience outside the cryptographic verifier, so an ID token minted for a different relying party on the same identity provider can be replayed to the viewer's authentication endpoint and log the attacker in as that token's subject. Only deployments that have opted into OpenID authentication and share an IdP/issuer with at least one other relying party are exposed; array-valued aud claims fail closed and single-RP setups are described by the vendor as not practically exploitable, and the viewer's per-login nonce/state binding narrows the window further. There is no KEV entry and no public exploit identified at time of analysis, but a fixed release (26.05) and the upstream commit are both public. EPSS was not supplied in the input.
Goobi Viewer deployments that leave webapi.authorization.token unset accept an empty ?token= value on every @AuthorizationBinding-protected REST endpoint, allowing an unauthenticated caller to invoke protected API methods. The official install guide generates a UUID token, so only installations that skipped that bootstrap step - typically test, staging, CI, or container images - are exposed; on those, an attacker can delete Solr records, read operational statistics and cache data, and, where the client-applications feature is used, read client secrets and grant a client access to restricted content. The issue is fixed in version 26.05, and no public exploit was identified at the time of analysis.
Unauthenticated path traversal in Goobi viewer allows a malicious HTTP server to supply an absolute path or ../ sequences in a Content-Disposition filename, causing the Tomcat process to write attacker-controlled content to any path it can write, including the deployed web application directory, which yields remote code execution as the tomcat OS user. Versions 24.03 through 26.04 are affected and 26.05 contains the fix. No public exploit identified at time of analysis, but the vulnerable download flow is reachable without authentication when the viewer fetches external resources.
Goobi viewer 24.03 through 26.04 exposes the DownloadTaskEndpoint WebSocket at /tasks/download/monitor.socket to unauthenticated users, so a remote attacker can drive the server's download machinery without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Depending on network reachability, that yields server-side request forgery against internal hosts such as the local Solr instance or cloud instance-metadata endpoints, retrieval of local files whose extensions fall inside the application's allow-list, and deletion of the Solr index through the Core Admin UNLOAD action, which leaves the viewer unavailable until a full re-index. The vendor scored the issue 9.8, while the independent assessment keeps the unauthenticated network vector but lowers integrity impact from high to low; no public exploit identified at time of analysis. Vendor-released patch: 26.05.
Unauthenticated Solr query injection in the Goobi viewer spatial search endpoint (GET /api/v1/index/{solrField}/spatial/search) lets remote attackers slip local-param syntax and boolean operators through the region parameter and bypass the access-condition filter, exposing metadata for access-restricted georeferenced records. Affected deployments are goobi-viewer-core from 22.04 up to but not including 26.05; disclosure is bounded to the map-feature payload the server renders - geographic coordinates, the document PI, and the metadata values placed into each feature's label/entities by the deployment's geomap templates - because the returned field set comes from a server-side allow-list, while non-georeferenced records and the unstored full-text field are unreachable this way and the sibling heatmap endpoint is unaffected. No public exploit code was identified at time of analysis, and the vendor issued a patch in 26.05.
Missing server-side authentication on four Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) lets any remote client open a connection without proving its HttpSession belongs to a logged-in user; versions 4.11.0 through 26.05 are affected. Through CampaignEndpoint an unauthenticated party can pollute the in-process crowdsourcing page-lock map and broadcast forged lock messages, disrupting reviewers working in active crowdsourcing campaigns, and because no endpoint checks the Origin header, logged-in users who visit an attacker-controlled page are exposed to cross-site WebSocket hijacking. Impact is confined to workflow integrity and limited confidentiality rather than system compromise, no public exploit was identified at time of analysis, and the vendor has released a patch in version 26.05.
Unauthenticated Solr query injection in the legacy RSS servlet (RssResolver, GET /rss/) of Goobi viewer-core prior to 26.05 lets an attacker alter the Solr query so that the trailing access-condition filter becomes optional, causing bibliographic metadata for access-restricted records to appear in the generated RSS feed. The exposed fields are limited to those the feed renders - title, author, publisher, place/year, shelfmark, URN, persistent identifier and record link - while full text is not stored in Solr and restricted thumbnails stay separately gated, so the practical impact is low-confidentiality disclosure plus count/oracle queries against the index. No public exploit code was identified at time of analysis; exploitation only yields sensitive results on instances that actually hold access-restricted records, and the vendor shipped a fix in 26.05 (tracked for patching this month by vuln.today prioritisation).
Predictable replacement-password generation in Goobi Viewer Core (Maven io.goobi.viewer:viewer-core) before 26.05 lets an attacker who can approximate the server-side generation time brute-force the password that is emailed after a reset and log in as the victim, giving high confidentiality and integrity impact at CVSS 6.8. Standalone exploitation is gated by two assessed preconditions: the account holder must have triggered the reset themselves (UI:R) and the attacker must infer server time from network or email metadata (AC:H), so mass exploitation is not trivial. No public exploit code was identified at time of analysis; the vendor fixed the flaw in 26.05, and the advisory notes that chaining it with CVE-2026-46346 (GHSA-gj5g-4rxf-8rmq) removes the victim-interaction requirement and reaches a combined severity of 9.1 Critical.
Unauthenticated remote attackers can force a password reset on any Goobi Viewer Core account prior to 26.05 because the reset token is derived predictably from the request timestamp. An attacker who knows the target's registered email address and can reach the exposed /user/resetpw/ endpoint can brute-force the token and invalidate the account password, locking the victim out. The flaw does not by itself disclose the new password or grant access; full unauthenticated account takeover requires chaining it with CVE-2026-46347. No confirmed public exploit code and no CISA KEV status were identified at time of analysis. The vendor-released fix is version 26.05.
Solr local-parameter injection in Goobi viewer core (23.03 through 26.05) lets unauthenticated remote attackers slip structural Solr parameters past the shared SolrTools.cleanUpQuery() sanitizer by wrapping them in a second pair of braces ({{!...}}): the greedy regex strips only the outer pair and a valid {!...} local parameter is forwarded to Solr. Any endpoint that routes user-supplied query strings through cleanUpQuery is exposed, and injected parent/child block joins, graph traversal or function queries can reveal which open-access top-level records have access-restricted sub-documents, although the outer access-condition filter still applies so the restricted content itself is not returned. The issue is fixed in 26.05, no public exploit was identified at time of analysis, and priority is assessed as this-month rather than immediate.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Reflected cross-site scripting in the IIIF Auth 2.0 endpoints auth/login and auth/token of Goobi Viewer Core (maven io.goobi.viewer:viewer-core) from version 25.08 up to, but not including, 26.05 allows remote unauthenticated attackers to execute JavaScript in a victim's viewer origin, scoring CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). The unvalidated origin query parameter is reflected into the Content-Security-Policy frame-ancestors response header and into an HTML body as a single-quoted JavaScript postMessage argument, and because the attacker controls both the login and token calls that initiate the flow, the payload is reachable without any pre-existing trust relationship. Exploitation requires a victim to be induced to open a crafted request (UI:R); the vendor notes a default install remains exploitable via top-level navigation because the shipped reverse-proxy configuration sets no script-src Content-Security-Policy, while the shipped X-Frame-Options: DENY and frame-ancestors 'self' block only the stealthier cross-origin iframe-delivery variant and the CSP-header malformation. No public exploit code was identified at time of analysis, but the priority decision label is act_now and the vendor has released a patch.
OpenID Connect login in Goobi viewer 25.01 through 26.04 validates the JWT audience outside the cryptographic verifier, so an ID token minted for a different relying party on the same identity provider can be replayed to the viewer's authentication endpoint and log the attacker in as that token's subject. Only deployments that have opted into OpenID authentication and share an IdP/issuer with at least one other relying party are exposed; array-valued aud claims fail closed and single-RP setups are described by the vendor as not practically exploitable, and the viewer's per-login nonce/state binding narrows the window further. There is no KEV entry and no public exploit identified at time of analysis, but a fixed release (26.05) and the upstream commit are both public. EPSS was not supplied in the input.
Goobi Viewer deployments that leave webapi.authorization.token unset accept an empty ?token= value on every @AuthorizationBinding-protected REST endpoint, allowing an unauthenticated caller to invoke protected API methods. The official install guide generates a UUID token, so only installations that skipped that bootstrap step - typically test, staging, CI, or container images - are exposed; on those, an attacker can delete Solr records, read operational statistics and cache data, and, where the client-applications feature is used, read client secrets and grant a client access to restricted content. The issue is fixed in version 26.05, and no public exploit was identified at the time of analysis.
Unauthenticated path traversal in Goobi viewer allows a malicious HTTP server to supply an absolute path or ../ sequences in a Content-Disposition filename, causing the Tomcat process to write attacker-controlled content to any path it can write, including the deployed web application directory, which yields remote code execution as the tomcat OS user. Versions 24.03 through 26.04 are affected and 26.05 contains the fix. No public exploit identified at time of analysis, but the vulnerable download flow is reachable without authentication when the viewer fetches external resources.
Goobi viewer 24.03 through 26.04 exposes the DownloadTaskEndpoint WebSocket at /tasks/download/monitor.socket to unauthenticated users, so a remote attacker can drive the server's download machinery without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Depending on network reachability, that yields server-side request forgery against internal hosts such as the local Solr instance or cloud instance-metadata endpoints, retrieval of local files whose extensions fall inside the application's allow-list, and deletion of the Solr index through the Core Admin UNLOAD action, which leaves the viewer unavailable until a full re-index. The vendor scored the issue 9.8, while the independent assessment keeps the unauthenticated network vector but lowers integrity impact from high to low; no public exploit identified at time of analysis. Vendor-released patch: 26.05.
Unauthenticated Solr query injection in the Goobi viewer spatial search endpoint (GET /api/v1/index/{solrField}/spatial/search) lets remote attackers slip local-param syntax and boolean operators through the region parameter and bypass the access-condition filter, exposing metadata for access-restricted georeferenced records. Affected deployments are goobi-viewer-core from 22.04 up to but not including 26.05; disclosure is bounded to the map-feature payload the server renders - geographic coordinates, the document PI, and the metadata values placed into each feature's label/entities by the deployment's geomap templates - because the returned field set comes from a server-side allow-list, while non-georeferenced records and the unstored full-text field are unreachable this way and the sibling heatmap endpoint is unaffected. No public exploit code was identified at time of analysis, and the vendor issued a patch in 26.05.
Missing server-side authentication on four Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) lets any remote client open a connection without proving its HttpSession belongs to a logged-in user; versions 4.11.0 through 26.05 are affected. Through CampaignEndpoint an unauthenticated party can pollute the in-process crowdsourcing page-lock map and broadcast forged lock messages, disrupting reviewers working in active crowdsourcing campaigns, and because no endpoint checks the Origin header, logged-in users who visit an attacker-controlled page are exposed to cross-site WebSocket hijacking. Impact is confined to workflow integrity and limited confidentiality rather than system compromise, no public exploit was identified at time of analysis, and the vendor has released a patch in version 26.05.
Unauthenticated Solr query injection in the legacy RSS servlet (RssResolver, GET /rss/) of Goobi viewer-core prior to 26.05 lets an attacker alter the Solr query so that the trailing access-condition filter becomes optional, causing bibliographic metadata for access-restricted records to appear in the generated RSS feed. The exposed fields are limited to those the feed renders - title, author, publisher, place/year, shelfmark, URN, persistent identifier and record link - while full text is not stored in Solr and restricted thumbnails stay separately gated, so the practical impact is low-confidentiality disclosure plus count/oracle queries against the index. No public exploit code was identified at time of analysis; exploitation only yields sensitive results on instances that actually hold access-restricted records, and the vendor shipped a fix in 26.05 (tracked for patching this month by vuln.today prioritisation).
Predictable replacement-password generation in Goobi Viewer Core (Maven io.goobi.viewer:viewer-core) before 26.05 lets an attacker who can approximate the server-side generation time brute-force the password that is emailed after a reset and log in as the victim, giving high confidentiality and integrity impact at CVSS 6.8. Standalone exploitation is gated by two assessed preconditions: the account holder must have triggered the reset themselves (UI:R) and the attacker must infer server time from network or email metadata (AC:H), so mass exploitation is not trivial. No public exploit code was identified at time of analysis; the vendor fixed the flaw in 26.05, and the advisory notes that chaining it with CVE-2026-46346 (GHSA-gj5g-4rxf-8rmq) removes the victim-interaction requirement and reaches a combined severity of 9.1 Critical.
Unauthenticated remote attackers can force a password reset on any Goobi Viewer Core account prior to 26.05 because the reset token is derived predictably from the request timestamp. An attacker who knows the target's registered email address and can reach the exposed /user/resetpw/ endpoint can brute-force the token and invalidate the account password, locking the victim out. The flaw does not by itself disclose the new password or grant access; full unauthenticated account takeover requires chaining it with CVE-2026-46347. No confirmed public exploit code and no CISA KEV status were identified at time of analysis. The vendor-released fix is version 26.05.
Solr local-parameter injection in Goobi viewer core (23.03 through 26.05) lets unauthenticated remote attackers slip structural Solr parameters past the shared SolrTools.cleanUpQuery() sanitizer by wrapping them in a second pair of braces ({{!...}}): the greedy regex strips only the outer pair and a valid {!...} local parameter is forwarded to Solr. Any endpoint that routes user-supplied query strings through cleanUpQuery is exposed, and injected parent/child block joins, graph traversal or function queries can reveal which open-access top-level records have access-restricted sub-documents, although the outer access-condition filter still applies so the restricted content itself is not returned. The issue is fixed in 26.05, no public exploit was identified at time of analysis, and priority is assessed as this-month rather than immediate.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.