CVE-2026-55442
Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection
Using goobi-viewer-core by intranda?
Get instant alerts when new vulnerabilities affect goobi-viewer-core - before attackers find them.
Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy \{(.+)\} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (4)
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- LOW
- Integrity
- NONE
- Availability
- NONE
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.