Live › vulnerability › CVE-2026-55442
Go to dashboardGoobi viewer's cleanUpQuery sanitizer can be bypassed by wrapping Solr local parameters in doubled curly braces, so a valid local parameter reaches Solr. An attacker can use injected Solr parameters to alter or extend search queries against the backend index.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Goobi viewer from 23.03 before 26.05 that accept user search input routed through SolrTools.cleanUpQuery are affected, and the double-brace bypass specifically applies from 23.10. The flaw sits in the shared sanitizer, so any endpoint using it is in scope. Teams not running Goobi viewer can skip it.
No product ranges from the sources yet.
26.05 or later, per the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy {(.+)} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-55442")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.