Live › vulnerability › CVE-2026-46651
Go to dashboardThe DownloadTaskEndpoint WebSocket at /tasks/download/monitor.socket accepts download requests from unauthenticated users in goobi-viewer-core versions 24.03 up to 26.05. The sources (CVSS 9.8, tagged ssrf) indicate an attacker can make the server fetch content on their behalf without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| goobi-viewer-core | maven | >= 24.03, < 26.05 | 26.05 |
Check the Maven dependency version of goobi-viewer-core in the project pom or build file; affected if 24.03 <= version < 26.05.
Upgrade goobi-viewer-core to 26.05 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-46651")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.