CVE-2026-55444

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet RssResolver, GET /rss/ accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates th...

CVE-2026-55444 Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet RssResolver, GET /rss/ accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates th...

CVE-2026-55444

The Goobi viewer web application is vulnerable to Solr query injection in versions prior to 26.05 . The flaw exists in the legacy RSS servlet (RssResolver , GET /rss/), which concatenates the q and filterQuery parameters into Solr queries without proper input validation. An unauthenticated attack...

CVE-2026-55444 Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet RssResolver, GET /rss/ accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates th...

EUVD-2026-109061

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet RssResolver, GET /rss/ accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates th...

CVE-2026-55444 Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet RssResolver, GET /rss/ accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates th...

PT-2026-122130

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet RssResolver, GET /rss/ accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates th...

Intranda goobi-viewer-core input validation error vulnerability

Versions of Intranda Goobi Viewer Core prior to 26.05 contain a security vulnerability. This vulnerability arises because the RSS servlet RssResolver, GET /rss/ fails to validate the q and filterQuery parameters and incorporates them into the Solr query. As a result, unauthenticated attackers may...