CVE-2026-46651EUVD-2026-109059
Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 26.05
- Public exploit
- None on Exploit-DB
Summary
The Goobi viewer web application, which displays digitised material in a browser, is affected. An unauthenticated attacker can abuse its download WebSocket endpoint to make the server request internal resources and read local files, potentially exposing sensitive data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
Affected versions
- intranda goobi-viewer-core
From 24.03 · fixed in 26.05