CVE-2026-46651
CVE-2026-46651 · Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
CVSS 9.8 · Crítica · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
goobi-viewer-core
- Versiones
- >= 24.03, < 26.05: Afectada
Sin corrección publicada
Fuentes originales
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8
- https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5
- https://github.com/intranda/goobi-viewer-core/commit/b8943ee963e2aa1131da2212eaf85c5a2d90214f
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
- https://nvd.nist.gov/vuln/detail/CVE-2026-46651