{"id":"CVE-2026-46651","aliases":[],"cve":{"records":[{"id":"CVE-2026-46651","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-05-15T20:11:54.585Z","published":"2026-10-23T14:15:28.088Z","modified":"2026-10-29T17:51:34.661Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T14:15:28.088Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T17:51:34.661Z"}],"references":[{"url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/intranda/goobi-viewer-core/commit/b8943ee963e2aa1131da2212eaf85c5a2d90214f","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-306","description":"CWE-306: Missing Authentication for Critical Function","source":"GitHub_M"},{"id":"CWE-552","description":"CWE-552: Files or Directories Accessible to External Parties","source":"GitHub_M"},{"id":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T17:51:22.546292Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.","score":9.8,"severity":"critical","published":"2026-10-23T14:15:28.088Z","modified":"2026-10-29T17:51:34.661Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"intranda","name":"goobi-viewer-core","platforms":[],"versions":[{"version":">= 24.03, < 26.05","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-46651"}],"remediation":[],"references":["https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8","https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5","https://github.com/intranda/goobi-viewer-core/commit/b8943ee963e2aa1131da2212eaf85c5a2d90214f","https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05"],"sources":[{"name":"CVE","id":"CVE-2026-46651","modified":"2026-10-29T17:51:34.661Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-46651"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-10-29T18:10:59.030Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:55:30.958Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T18:25:34.933Z","attemptedAt":"2026-10-29T18:25:34.933Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T18:25:34.051Z","attemptedAt":"2026-10-29T18:25:34.051Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T18:25:34.070Z","attemptedAt":"2026-10-29T18:25:34.070Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T18:25:34.080Z","attemptedAt":"2026-10-29T18:25:34.080Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-109059","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109059","modified":"Oct 29, 2026, 5:51:34 PM","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-29T18:25:34.070Z"},{"source":"FIRST EPSS","id":"CVE-2026-46651","url":"https://www.first.org/epss/","probability":0.00378,"percentile":0.31682,"date":"2026-10-29","checkedAt":"2026-10-29T18:25:34.080Z"},{"source":"NVD","id":"CVE-2026-46651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46651","modified":"2026-10-29T18:17:31.917","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-29T18:25:34.933Z"}],"aiSummary":{"text":"Goobi viewer versions 24.03 to before 26.05 have an unauthenticated SSRF and local file inclusion vulnerability via the DownloadTaskEndpoint WebSocket endpoint. An unauthenticated attacker can send download requests. This issue was patched in version 26.05.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:52:28.381Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-46651"}]}}