CVE-2026-55442 intranda CVE debrief

Who should care

Defenders responsible for Goobi viewer installations, Solr administrators, and security teams should assess exposure and prioritize patching. They should also verify user input, monitor for suspicious activity, and review system logs for potential exploitation attempts. Additionally, they should consider the potential impact on search queries and system performance.

Why it matters

The Goobi viewer vulnerability allows attackers to inject arbitrary Solr local parameters, potentially impacting search queries and system performance. Defenders should prioritize patching, verify user input, and monitor for suspicious activity.

• Potential for Solr local parameter injection, allowing attackers to manipulate search queries
• Possible impact on search results, data retrieval, and system performance
• Need for verification of user input to prevent similar vulnerabilities
• Priority for patching and monitoring to prevent exploitation

Technical summary

The SolrTools.cleanUpQuery() function in the Goobi viewer is vulnerable to a double-brace bypass, allowing attackers to inject arbitrary Solr local parameters. This affects versions from 23.03 to before 26.05. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10. An attacker can exploit this vulnerability to manipulate search queries and potentially impact system performance. Defenders should prioritize patching to version 26.05 or later.

Defensive priority

Defenders should prioritize patching to version 26.05 or later, verify and restrict user input to Solr queries, and monitor for suspicious Solr query activity.

Recommended defensive actions

• Patch to version 26.05 or later
• Verify and restrict user input to Solr queries
• Monitor for suspicious Solr query activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the affected versions. The vendor, intranda, has provided patches and advisories for this issue. Defenders should verify user input, monitor for suspicious activity, and review system logs for potential exploitation attempts. The vulnerability affects versions from 23.03 to before 26.05 of the Goobi viewer. Evidence from the CVE Program and NVD detail page confirms the vulnerability and provides additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.