CVE-2026-55442: CWE-20: Improper Input Validation in intranda goobi-viewer-core

The Goobi viewer web application uses SolrTools.cleanUpQuery() to sanitize user input by removing Solr local-parameter syntax ({!...}) from query strings before they reach Solr. From version 23.10, the regex used for sanitization is greedy and matches a single pair of curly braces, allowing an attacker to bypass it by wrapping the local parameter in double curly braces ({{!...}}). The outer braces are stripped, but the inner {!...} remains intact and is forwarded to Solr, potentially enabling unintended query manipulation. This issue affects all endpoints routing user input through cleanUpQuery and is present in versions >=23.03 and <26.05. The vulnerability has been fixed in version 26.05.

An attacker can bypass input sanitization to inject Solr local parameters into queries, which may lead to unintended query behavior or information disclosure. The CVSS score of 5.3 (medium severity) reflects limited confidentiality impact and no integrity or availability impact. There are no known exploits in the wild.

This vulnerability has been officially fixed in intranda goobi-viewer-core version 26.05. Users should upgrade to version 26.05 or later to remediate the issue. No additional mitigation is required if the fix is applied.