CVE-2026-46651GHSA-79jg-3m2m-jgc8

goobi-viewer-core: Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

intranda goobi-viewer-core

Open in Threatline Record JSON

CVSS

9.8Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@stackflag.bsky.social: CVE-2026-46651 - goobi-viewer-core The Goobi viewer web app (versions 24.03 up to before 26.05) allows users who are not logged in to send download requests through a WebSocket endBluesky: CVE posts, 23 Oct 2026

Description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.

Text from CVE List

Affected versions 2

goobi-viewer-coreaffected: >= 24.03, < 26.05CVE List
io.goobi.viewer:viewer-core, maven>=24.03GitHub