CVE-2026-46651: Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
goobi-viewer-coreto a version that resolves this vulnerability.Fixed in 26.05
Event History
Frequently Asked Questions
Which deployments are affected?
Goobi goobi-viewer-core versions 24.03 through versions before 26.05 are affected. Version 26.05 contains the patch.
Does an attacker need an account or user interaction?
No. The affected DownloadTaskEndpoint WebSocket endpoint accepts download requests from unauthenticated users, so exploitation does not require credentials or user interaction.
What endpoint should be reviewed for exposure?
Review whether /tasks/download/monitor.socket is reachable by untrusted users. This is the affected DownloadTaskEndpoint WebSocket endpoint.
What should be done if the application cannot immediately be upgraded?
Restrict untrusted access to /tasks/download/monitor.socket until the deployment can be updated to version 26.05.