Web Application Vulnerability in Goobi Viewer by Intranda

CVE-2026-55442

What is CVE-2026-55442?

The Goobi viewer, developed by Intranda, is a web-based application that enables the display of digitized materials. A vulnerability was identified in versions 23.03 up to before 26.05, relating to the SolrTools.cleanUpQuery() function, which improperly handles user-supplied query strings. By cleverly wrapping Solr local-parameter syntax within an additional pair of curly braces, an attacker could bypass the regex protection in place, allowing unauthorized access to parameters sent to Solr. This flaw, affecting any endpoint that utilizes the shared sanitizer, underscores the importance of robust input validation mechanisms. Users are encouraged to upgrade to version 26.05 or later to mitigate this risk, where the issue has been addressed.

References