CVE-2026-55444: Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Goobi viewerto a version that resolves this vulnerability.Fixed in 26.05
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Goobi viewer deployments running a version before 26.05 are affected if the legacy RssResolver endpoint at GET /rss/ is reachable. The issue is in the legacy servlet rather than the validated GET /api/v1/records/rss endpoint.
What does an attacker need to exploit it?
An attacker needs no authentication or user interaction. They can supply crafted q or filterQuery parameters to the legacy RSS endpoint and inject Solr boolean operators; q has the broader scope.
What is the impact of successful exploitation?
An attacker can make the trailing access-condition filter optional and cause access-restricted records to be included in a generated RSS feed. The stated impact is exposure of restricted record data, with no integrity or availability impact described.
What should be done if an immediate upgrade is not possible?
The provided data identifies the legacy GET /rss/ servlet as affected and GET /api/v1/records/rss as having input validation. Restricting access to or disabling the legacy RSS endpoint reduces exposure until upgrading to version 26.05.