# CVE-2026-55444: Goobi viewer Solr injection in RSS servlet

Source: https://junglewise.ai/threats/cve-2026-55444-the-goobi-viewer-is-a-web-application-that-allows-digitised  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-55444 · Severity: medium · CVSS 5.3 · Published 2026-10-23

Goobi viewer is a web application that displays digitized library materials and archives in a web browser. Its legacy RSS feed servlet fails to validate user input before passing it to Solr search queries, allowing attackers to inject operators that bypass access restrictions. An unauthenticated attacker can craft a malicious RSS request to expose restricted or confidential digitized documents that should not be publicly visible.

Technologies: [Intranda Goobi viewer](https://junglewise.ai/threats/technologies/goobi-viewer). Vendors: [Intranda](https://junglewise.ai/threats/vendors/intranda).

## Quick answers

**Is CVE-2026-55444 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55444 being exploited in the wild.

**How severe is CVE-2026-55444?** Medium severity, with a CVSS score of 5.3, published 23 October 2026.

**Which products and versions are affected?** Intranda Goobi viewer before 26.05.

**Is there a fix for CVE-2026-55444?** Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55444 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55444?** Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.05

## Technical details

The RssResolver servlet's GET /rss/ endpoint concatenates unauthenticated q and filterQuery parameters into Solr queries without validation, whereas the newer REST API layer (GET /api/v1/records/rss) performs proper input validation. An attacker can inject Solr boolean operators to break out of the wrapping parentheses and render the trailing access-condition filter-query suffix optional, causing the Solr query to return access-restricted records. The vulnerability affects versions before 26.05.

## Affected products

- intranda Goobi viewer before 26.05

## Timeline

- 2026-10-23: disclosed

## References

- [https://github.com/intranda/goobi-viewer-core/commit/e8d987f8478b86559ef3ea236be0d86e08948f6b](https://github.com/intranda/goobi-viewer-core/commit/e8d987f8478b86559ef3ea236be0d86e08948f6b)
- [https://github.com/intranda/goobi-viewer-core/commit/fcdae14b06e99f3320a02d45a6be7fc6e5c69a6e](https://github.com/intranda/goobi-viewer-core/commit/fcdae14b06e99f3320a02d45a6be7fc6e5c69a6e)

## Related threats

- [Goobi viewer reflected XSS in IIIF Auth endpoints](https://junglewise.ai/threats/cve-2026-55486-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in spatial search endpoint](https://junglewise.ai/threats/cve-2026-55465-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass in OpenID token validation](https://junglewise.ai/threats/cve-2026-55459-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass via empty API token](https://junglewise.ai/threats/cve-2026-55457-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr query injection via regex bypass](https://junglewise.ai/threats/cve-2026-55442-the-goobi-viewer-is-a-web-application-that-allows-digitised)