{"id":"CVE-2026-55442","aliases":[],"cve":{"records":[{"id":"CVE-2026-55442","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-16T21:59:57.018Z","published":"2026-10-23T14:14:26.455Z","modified":"2026-10-29T13:56:19.871Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T14:14:26.455Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T13:56:19.871Z"}],"references":[{"url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2r24-qxpf-cj65","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/intranda/goobi-viewer-core/commit/5a59ffa5d76169a4ad3cc396023ad4a4eca217da","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-20","description":"CWE-20: Improper Input Validation","source":"GitHub_M"},{"id":"CWE-116","description":"CWE-116: Improper Encoding or Escaping of Output","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T13:56:01.328914Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy \\{(.+)\\} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.","score":5.3,"severity":"medium","published":"2026-10-23T14:14:26.455Z","modified":"2026-10-29T13:56:19.871Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"intranda","name":"goobi-viewer-core","platforms":[],"versions":[{"version":">= 23.03, < 26.05","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-55442"}],"remediation":[],"references":["https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2r24-qxpf-cj65","https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e","https://github.com/intranda/goobi-viewer-core/commit/5a59ffa5d76169a4ad3cc396023ad4a4eca217da","https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05"],"sources":[{"name":"CVE","id":"CVE-2026-55442","modified":"2026-10-29T13:56:19.871Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-55442"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:11:12.699Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T08:35:32.065Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Goobi viewer versions 23.03 to 26.05 have a vulnerability where an attacker can bypass input validation by wrapping Solr local parameters in double curly braces, allowing arbitrary Solr local-param injection. The flaw affects any endpoint that uses the cleanUpQuery function. The issue is due to improper input validation and encoding.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:20:12.869Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-55442"}]}}