# CVE-2026-55442: Goobi viewer Solr query injection via regex bypass

Source: https://junglewise.ai/threats/cve-2026-55442-the-goobi-viewer-is-a-web-application-that-allows-digitised  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-55442 · Severity: medium · CVSS 5.3 · Published 2026-10-23

Goobi viewer is a web application that displays digitized material in browsers. A flaw in its Solr query sanitizer allows attackers to inject Solr local parameters by wrapping them in double braces, bypassing the intended restrictions. This could enable unauthorized access to documents, data extraction, or administrative functions depending on what queries can be executed through the vulnerable endpoints.

Technologies: [Intranda Goobi viewer](https://junglewise.ai/threats/technologies/goobi-viewer). Vendors: [Intranda](https://junglewise.ai/threats/vendors/intranda).

## Quick answers

**Is CVE-2026-55442 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55442 being exploited in the wild.

**How severe is CVE-2026-55442?** Medium severity, with a CVSS score of 5.3, published 23 October 2026.

**Which products and versions are affected?** Intranda Goobi viewer 23.03 to before 26.05.

**Is there a fix for CVE-2026-55442?** Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55442 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55442?** Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.05

## Technical details

The SolrTools.cleanUpQuery() method uses a greedy regex pattern to strip Solr local-parameter syntax ({!...}) from user input before it reaches Solr, but the pattern can be bypassed by double-bracing: {{!...}} has its outer braces stripped, leaving {!...} intact and forwarded to Solr. The vulnerability affects any endpoint routing user input through this sanitizer, with the double-brace bypass present from v23.10 onward. A network attacker with access to affected search endpoints can inject arbitrary Solr local parameters without authentication.

## Affected products

- intranda Goobi viewer 23.03 to before 26.05

## Timeline

- 2026-10-23: disclosed

## References

- [https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e](https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e)
- [https://github.com/intranda/goobi-viewer-core/commit/5a59ffa5d76169a4ad3cc396023ad4a4eca217da](https://github.com/intranda/goobi-viewer-core/commit/5a59ffa5d76169a4ad3cc396023ad4a4eca217da)

## Related threats

- [Goobi viewer reflected XSS in IIIF Auth endpoints](https://junglewise.ai/threats/cve-2026-55486-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in spatial search endpoint](https://junglewise.ai/threats/cve-2026-55465-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass in OpenID token validation](https://junglewise.ai/threats/cve-2026-55459-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass via empty API token](https://junglewise.ai/threats/cve-2026-55457-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in RSS servlet](https://junglewise.ai/threats/cve-2026-55444-the-goobi-viewer-is-a-web-application-that-allows-digitised)