◆ CVE Hub

CVE-2026-46651

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

Published
2026-10-23
Last modified
2026-10-23
CNA
GitHub_M
NVD status
Deferred
CWE
CWE-306 CWE-552 CWE-918

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
9.8
CRITICAL
Scored by github.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
9.8
CRITICAL
Scored by CNA (GitHub_M) · v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS exploit probability
0.7%
Percentile 52.6%
as of 2026-10-24
CISA KEV
—
Not listed

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkNo authNo interaction Confidentiality HIntegrity HAvailability H

This vulnerability may be exploitable over the internet without authentication or user interaction.

MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACLLow (easy)
Privileges required PRNNone
User interaction UINNone
Scope SUUnchanged
Confidentiality CHHigh
Integrity IHHigh
Availability AHHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

NVD

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.

CVSS assessments

ProviderVersionScoreVector
NVD / [email protected] (Secondary)3.19.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA / GitHub_M3.19.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products and packages

CNA (CVE.org)

VendorProductVersions
intrandagoobi-viewer-core
affected: >= 24.03, < 26.05

Linux distribution status

Red Hat ↗ Fetching

Debian ↗

No record

Ubuntu ↗ Fetching

References (4)