CVE-2026-46651 intranda CVE debrief

Who should care

Defenders responsible for the Goobi viewer application, specifically those managing the goobi-viewer-core package, should assess exposure and prioritize patching or mitigation efforts.

Why it matters

CVE-2026-46651 is a critical vulnerability in the Goobi viewer application that allows for SSRF and local file inclusion attacks. Defenders should prioritize patching or mitigation efforts to prevent potential unauthorized access to internal resources and sensitive files.

• Potential for SSRF attacks, which could lead to unauthorized access to internal resources
• Potential for local file inclusion attacks, which could lead to unauthorized access to sensitive files
• Need for verification of affected versions and patching or mitigation efforts
• Potential impact on digitized material accessibility and integrity

Technical summary

The DownloadTaskEndpoint WebSocket endpoint in goobi-viewer-core accepts download requests from unauthenticated users, allowing for SSRF and local file inclusion attacks. The vulnerability affects versions from 24.03 to before 26.05. Defenders should assess exposure and prioritize patching or mitigation efforts to prevent potential unauthorized access to internal resources and sensitive files. The vulnerability has a critical severity and requires immediate attention to prevent potential SSRF and local file inclusion attacks.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability as soon as possible due to its critical severity and potential for SSRF and local file inclusion attacks.

Recommended defensive actions

• Patch goobi-viewer-core to version 26.05 or later
• Restrict access to the DownloadTaskEndpoint WebSocket endpoint
• Monitor for suspicious activity related to SSRF and local file inclusion attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, additional information from other sources may be necessary to fully assess and mitigate the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.