{"schema":"threatline.record/2","record":{"id":"CVE-2026-46651","aliases":["GHSA-79jg-3m2m-jgc8"],"summary":"Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer","details":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.","categories":["Unclassified"],"product":"goobi-viewer-core","vendor":"intranda","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46651","source_modified_at":"2026-10-23T14:15:28.088Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"goobi-viewer-core","vendor":"intranda","versions":[{"version":">= 24.03, < 26.05","status":"affected"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8","source_modified_at":"2026-06-18T14:28:56Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"io.goobi.viewer:viewer-core"},"range":">=24.03"}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T14:15:28.088Z","modified_at":"2026-10-23T14:15:28.088Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-46651","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T14:15:28.088Z"},{"source":"GitHub Advisory Database","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-06-18T14:28:56Z"}],"sources":["CVE List","GitHub Advisory Database"],"references":[{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/commit/b8943ee963e2aa1131da2212eaf85c5a2d90214f","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T14:15:28.088Z","content_hash":"306f72aeecdb0cb62d7319e8491147949f8f5c394dfb189782ed6fe0ba6d9461"}}