Vulnerabilities

TI-2026-79937 CVE-2026-55486

Reflected XSS in Goobi viewer IIIF Auth authorization endpoints

MEDIUM 42

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00257 Published 2026-10-23 Fixed in 26.05 CWE-113

TI-2026-79936 CVE-2026-55465

Solr injection in Goobi viewer exposes access-restricted records

LOW 30

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00262 Published 2026-10-23 Fixed in 26.05 CWE-89

TI-2026-79935 CVE-2026-55463

Goobi viewer WebSocket endpoints lack authentication checks

LOW 34

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00136 Published 2026-10-23 Fixed in 26.05 CWE-1385

TI-2026-79934 CVE-2026-55459

Goobi viewer accepts OpenID tokens issued for other relying parties

LOW 34

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00205 Published 2026-10-23 Fixed in 26.05 CWE-287

TI-2026-79933 CVE-2026-55457

Authorization bypass in Goobi viewer via empty default API token

LOW 34

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00274 Published 2026-10-23 Fixed in 26.05 CWE-1392

TI-2026-79932 CVE-2026-55444

Solr injection in Goobi viewer RSS feed exposes restricted records

LOW 30

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00253 Published 2026-10-23 Fixed in 26.05 CWE-20

TI-2026-79924 CVE-2026-46652

Path traversal in Goobi viewer lets malicious servers write files

MEDIUM 50

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00703 Published 2026-10-23 Fixed in 26.05 CWE-22

TI-2026-79923 CVE-2026-46651

Unauthenticated SSRF and local file inclusion in Goobi viewer

MEDIUM 49

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00378 Published 2026-10-23 Fixed in 26.05 CWE-306

TI-2026-79921 CVE-2026-46347

Goobi viewer generates predictable replacement passwords after reset

LOW 32

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00253 Published 2026-10-23 Fixed in 26.05 CWE-330

TI-2026-79920 CVE-2026-46346

Predictable password reset token in Goobi viewer

LOW 35

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00334 Published 2026-10-23 Fixed in 26.05 CWE-330

TI-2026-79931 CVE-2026-55442

Goobi viewer sanitizer bypass allows Solr local-parameter injection

LOW 24

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00262 Published 2026-10-23 Fixed in 26.05 CWE-116

TI-2026-32930 CVE-2026-45083 · GHSA-2rgp-f66f-4499

Goobi viewer: Unauthenticated Solr Streaming Expression Proxy

MEDIUM 49

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0041 Published 2026-05-27 Fixed in 26.04.1 CWE-306

TI-2023-13477 CVE-2023-29016 · GHSA-2r9r-8fcg-m38g

Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames

LOW 28

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2023-04-06 Fixed in 23.03 CWE-79

TI-2023-13476 CVE-2023-29015 · GHSA-622w-995c-3c3h

Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments

LOW 28

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2023-04-06 Fixed in 23.03 CWE-79

TI-2023-13475 CVE-2023-29014 · GHSA-7v7g-9vx6-vcg2

Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter

LOW 28

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2023-04-06 Fixed in 23.03 CWE-79

TI-2020-11897 CVE-2020-15124

Path traversal in Goobi viewer Core

MEDIUM 44

In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01538 Published 2020-07-22 Fixed in 4.8.3 CWE-22

Vulnerabilities

Filters