CVE-2026-55442
- Source
- https://cve.org/CVERecord?id=CVE-2026-55442
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55442.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55442
- Aliases
-
- GHSA-2r24-qxpf-cj65
- Published
- 2026-10-23T14:14:26Z
- Modified
- 2026-10-31T07:03:11Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection
- Details
-
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy {(.+)} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-116", "CWE-20" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55442.json" }- References
-
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55442.json
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2r24-qxpf-cj65
- https://nvd.nist.gov/vuln/detail/CVE-2026-55442
- https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e
- https://github.com/intranda/goobi-viewer-core/commit/5a59ffa5d76169a4ad3cc396023ad4a4eca217da
Affected packages
Git / github.com/intranda/goobi-viewer-core
Affected ranges
- Type
- GIT
- Repo
- https://github.com/intranda/goobi-viewer-core
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "23.03" }, { "fixed": "26.05" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "330da2f8255a9ed2200ba46b98bb9b6a88748a4e" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "5a59ffa5d76169a4ad3cc396023ad4a4eca217da" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v26.05", "range": [ { "fixed": "7e5e9de18c572c7b96f80efe01254bf08dc4cdb4" } ], "source": "REFERENCES_TAG" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55442.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"155753272986554581499195543406063954601",
"258372791311626257344576396953479823756",
"210621050731296146770272549214747825958"
],
"threshold": 0.9
},
"id": "CVE-2026-55442-133e52dc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/solr/SolrToolsTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "15972731808254145666261176205669785459",
"length": 2933
},
"id": "CVE-2026-55442-2ad86a12",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java",
"function": "getAdvancedSearchSelectItems"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293943419837386175782308880630292377328",
"170127000326944715759514306120173437552",
"223072314872435556758862870822129730388",
"184713866145576581573500654664532882358",
"237588089203428832734919670992173305409",
"280990611135733430789396002312530922372",
"24011410402069477058498461939093920262",
"243679154761233145932008628234109855606",
"21245126937807009457669850870559185657",
"157573805690410280521963065924689943951",
"49299172231513956195727309028396980246",
"249794867519244567083176728280977870199",
"71331133885813258577251813447387200972",
"231280190624403314206933099108260677099",
"131064644070503162456003862872168843296",
"228717970448403275474455688186333628072",
"147229437546344567055115541779032048353",
"296771280783092075493187168226162854698",
"120686590177198208650842153671343843197",
"185110271319730517681325665849978046676",
"133072927174758095098837509638475082729",
"106915568864856288436707486586529388843",
"160461748305160759432425790653772593920",
"317668832181560233029467657143735579550",
"73682667438275365798270958473607512942",
"249449434883737352069413629640348278192",
"195647711537184443325539778426838681880",
"257419450339920369642547725144123517283",
"112254453685341924447530792146304337784",
"200506628299564351230936520852436132030",
"99422724347327295676833174058837105043",
"141225596712123407189091063186974358645",
"281192752199487692721550185112564389005",
"194840973750847596253923718843247966422",
"336380174445271318603843347024206517237",
"96952457555478317003593573357220284563",
"288939005615045911177043736404399404541",
"328674136467211459900128018005816102742",
"75851200508167515578606821188405267014",
"230110937255770512631639417010960709132",
"243367955632336005134513142238333853843",
"253728686788632627169401501763323725722",
"28196279546092511104474535655606889983",
"240985082911872732109250870253022523110",
"7405899224190688798808783959628142002",
"91368197618688457157980371544354479789",
"158697872569671941832991527465912955348",
"305106691200856417832257034142201370878",
"289336218389088023408326258965270312936",
"32131413311487982245812841291902270705",
"133528045941229369766499737505022324454",
"118600259359074066127455075675860467005",
"277131013592039677111080227322086714878",
"12132793595964136568255504321677124068",
"237513637503532782536650314870439478037",
"203609570456295320982548574336354293445",
"51906176174227463930981612168786621659",
"198425266314817376550601752740401743673",
"239541424654697691920923576302018587810",
"4477980581229884955895429889103133623",
"65554406765763519915522339427629544886"
],
"threshold": 0.9
},
"id": "CVE-2026-55442-46a7ca97",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"292318736014489239916363703015843933292",
"33342444948932622885852297362400241110",
"150627378087297952261201379269681688615",
"196032133924619831682861796980968469138",
"229803355209219361778415706561086726371",
"150154138193598813965628245584495049179",
"317997783332699702296697415359344748429",
"59201442135033630141344734281830530591",
"236988440403550928763929844223715573932",
"321489826871792755483077617760847687747"
],
"threshold": 0.9
},
"id": "CVE-2026-55442-5fe98c02",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/solr/SolrTools.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "103515649166144788248541080637830266894",
"length": 248
},
"id": "CVE-2026-55442-69637866",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/solr/SolrTools.java",
"function": "cleanUpQuery"
}
}
]
vanir_signatures_modified
"2026-10-31T07:03:11Z"