---
id: CVE-2026-55444
title: >-
  Goobi viewer: Solr query injection via the legacy RSS servlet q and
  filterQuery parameters
summary: >-
  The Goobi viewer is a web application that allows digitised material to be
  displayed in a web browser. Prior to version 26.05, the legacy RSS servlet
  (RssResolver, GET /rss/) accepts the q and filterQuery parameters and
  concatenates them…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-20
  - CWE-89
  - CWE-943
vendor: intranda
product: goobi-viewer-core
affected:
  - goobi-viewer-core < 26.05
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T14:16:16.350Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-55444'
references:
  - url: >-
      https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-763m-wjm9-6873
    label: >-
      https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-763m-wjm9-6873
  - url: >-
      https://github.com/intranda/goobi-viewer-core/commit/e8d987f8478b86559ef3ea236be0d86e08948f6b
    label: >-
      https://github.com/intranda/goobi-viewer-core/commit/e8d987f8478b86559ef3ea236be0d86e08948f6b
  - url: >-
      https://github.com/intranda/goobi-viewer-core/commit/fcdae14b06e99f3320a02d45a6be7fc6e5c69a6e
    label: >-
      https://github.com/intranda/goobi-viewer-core/commit/fcdae14b06e99f3320a02d45a6be7fc6e5c69a6e
  - url: 'https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05'
    label: 'https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05'
tags:
  - cve.org
ingestedAt: '2026-10-23T14:28:08.695Z'
---

## Overview

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.

## Affected

- `goobi-viewer-core < 26.05`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.