CVE-2026-46651criticalCWE-306CWE-552CWE-918

CVE-2026-46651: fallo crítico en intranda goobi-viewer-core

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear goobi-viewer-core

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.4%
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
intranda · goobi-viewer-core
CVEs relacionadas — intranda goobi-viewer-core

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-15124CRITICALPath traversal in Goobi viewer CoreEPSS 1.5%CVE-2026-46652CRITICALPath traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerEPSS 0.7%CVE-2023-29016MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User NicknamesEPSS 0.4%CVE-2023-29015MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User Comments EPSS 0.4%CVE-2023-29014MEDIUMGoobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID ParameterEPSS 0.4%CVE-2026-45083CRITICALGoobi viewer: Unauthenticated Solr Streaming Expression ProxyEPSS 0.4%