CVE-2026-46651criticalCWE-306CWE-552CWE-918

CVE-2026-46651: falha crítica em intranda goobi-viewer-core

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar goobi-viewer-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.4%
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
intranda · goobi-viewer-core
CVEs relacionadas — intranda goobi-viewer-core

No mesmo produto, das mais perigosas para as menos.

CVE-2020-15124CRITICALPath traversal in Goobi viewer CoreEPSS 1.5%CVE-2026-46652CRITICALPath traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerEPSS 0.7%CVE-2023-29016MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User NicknamesEPSS 0.4%CVE-2023-29015MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User Comments EPSS 0.4%CVE-2023-29014MEDIUMGoobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID ParameterEPSS 0.4%CVE-2026-45083CRITICALGoobi viewer: Unauthenticated Solr Streaming Expression ProxyEPSS 0.4%