CVE-2026-55465: Goobi viewer: Solr injection via unvalidated region parameter in spatial search
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with no escaping, no local-param stripping, and no runtime schema enforcement (the OpenAPI @Schema(pattern=...) annotation is documentation-only at the JAX-RS layer). An attacker can inject Solr local-param syntax ({!parent ...}, {!join ...}) and boolean operators to make access-restricted georeferenced records match the query, bypassing the access-condition filter. This issue has been patched in version 26.05.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Goobi viewerto a version that resolves this vulnerability.Fixed in 26.05
Event History
Frequently Asked Questions
Which deployments are exposed?
Goobi viewer deployments from version 22.04 up to, but not including, 26.05 are affected if the unauthenticated spatial-search REST endpoint is available. The issue can expose access-restricted georeferenced records through search results.
Does exploitation require an account or user interaction?
No. The affected endpoint is unauthenticated, and the supplied severity vector indicates that exploitation can be performed remotely with no privileges or user interaction.
What input does an attacker need to control?
An attacker needs to supply the region query parameter to GET /api/v1/index/{solrField}/spatial/search. The vulnerable versions concatenate this value into a Solr query without escaping or stripping Solr local-parameter syntax.
How can this be remediated?
Upgrade Goobi viewer to version 26.05, which contains the patch. The provided information does not identify an alternative mitigation for deployments that cannot be upgraded.