CVE-2026-55442 Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery strips Solr local-parameter syntax !... from user-supplied query strings before they reach Solr. Its regex can be bypassed by...

CVE-2026-55442

The Goobi viewer web application (versions 23.03 to before 26.05 ) contains a vulnerability in the SolrTools.cleanUpQuery() shared sanitizer. The flaw allows for arbitrary Solr local-parameter injection because the regex used to strip local-parameter syntax ({!...}) can be bypassed by wrapping th...