CVE-2026-55442: Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

Q: Which deployments are affected by the double-brace bypass?

The double-brace bypass applies to Goobi viewer versions from 23.10 through versions before 26.05. The vulnerable sanitization is shared, so any endpoint that passes user-controlled query input through SolrTools.cleanUpQuery() may be affected.

Q: What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely without authentication or user interaction by supplying a query containing a Solr local parameter wrapped in double braces, such as {{!...}}. The outer braces are removed by the sanitizer while the inner local-parameter syntax reaches Solr.

Q: Are default deployments affected?

The available information identifies the shared cleanUpQuery() sanitizer as the affected component, but does not specify particular default endpoints or configurations. Exposure depends on whether an endpoint accepts user-supplied query strings and routes them through that sanitizer.

Q: What should teams do if they cannot immediately upgrade?

The provided information identifies version 26.05 as the patched release. No temporary mitigation is specified; prioritize restricting or reviewing endpoints that accept user-controlled query strings and pass them to cleanUpQuery().

Q: How can I determine whether my instance is vulnerable?

Check the deployed Goobi viewer version and identify endpoints that route user input through SolrTools.cleanUpQuery(). Versions before 26.05 require review, and versions from 23.10 are specifically affected by the documented {{!...}} bypass.

Published Oct 23, 2026

Updated

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy \{(.+)\} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.

Affected Software

1 affected component

Goobi Goobi viewer>=23.10<26.05

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Goobi viewer to a version that resolves this vulnerability.
Fixed in 26.05

Event History

Oct 23, 2026

CVE Published

via MITRE·02:14 PM

Data Sourced

via MITRE·02:14 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected by the double-brace bypass?

The double-brace bypass applies to Goobi viewer versions from 23.10 through versions before 26.05. The vulnerable sanitization is shared, so any endpoint that passes user-controlled query input through SolrTools.cleanUpQuery() may be affected.

What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely without authentication or user interaction by supplying a query containing a Solr local parameter wrapped in double braces, such as {{!...}}. The outer braces are removed by the sanitizer while the inner local-parameter syntax reaches Solr.

Are default deployments affected?

The available information identifies the shared cleanUpQuery() sanitizer as the affected component, but does not specify particular default endpoints or configurations. Exposure depends on whether an endpoint accepts user-supplied query strings and routes them through that sanitizer.

What should teams do if they cannot immediately upgrade?

The provided information identifies version 26.05 as the patched release. No temporary mitigation is specified; prioritize restricting or reviewing endpoints that accept user-controlled query strings and pass them to cleanUpQuery().

How can I determine whether my instance is vulnerable?

Check the deployed Goobi viewer version and identify endpoints that route user input through SolrTools.cleanUpQuery(). Versions before 26.05 require review, and versions from 23.10 are specifically affected by the documented {{!...}} bypass.

CVE-2026-55442: Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected by the double-brace bypass?

What does an attacker need to exploit this issue?

Are default deployments affected?

What should teams do if they cannot immediately upgrade?

How can I determine whether my instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected by the double-brace bypass?

What does an attacker need to exploit this issue?

Are default deployments affected?

What should teams do if they cannot immediately upgrade?

How can I determine whether my instance is vulnerable?