CVE-2026-55444 intranda CVE debrief

Who should care

Defenders responsible for Goobi viewer instances should assess exposure and prioritize upgrading to version 26.05 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and implement remediation or compensating controls.

Why it matters

The Solr query injection vulnerability in the Goobi viewer legacy RSS servlet allows unauthenticated attackers to potentially access restricted records.

• Potential unauthorized access to restricted records
• Possible injection of Solr boolean operators
• Need for verification of exposure and remediation

Technical summary

The Goobi viewer legacy RSS servlet is vulnerable to Solr query injection via the q and filterQuery parameters. This allows unauthenticated attackers to potentially access restricted records. The vulnerability affects the legacy RSS servlet (RssResolver, GET /rss/) which accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 26.05 or later.

Recommended defensive actions

• Verify exposure by checking if the Goobi viewer instance is using a version prior to 26.05
• Upgrade to version 26.05 or later
• Monitor RSS feeds for potential Solr query injection attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the Solr query injection vulnerability in the Goobi viewer legacy RSS servlet. The vulnerability allows unauthenticated attackers to inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.