{"id":"CVE-2026-55442","summary":"Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection","details":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy \\{(.+)\\} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.","aliases":["GHSA-2r24-qxpf-cj65"],"modified":"2026-10-31T07:03:11.972708794Z","published":"2026-10-23T14:14:26.455Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-116","CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55442.json"},"references":[{"type":"WEB","url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55442.json"},{"type":"ADVISORY","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2r24-qxpf-cj65"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55442"},{"type":"FIX","url":"https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e"},{"type":"FIX","url":"https://github.com/intranda/goobi-viewer-core/commit/5a59ffa5d76169a4ad3cc396023ad4a4eca217da"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/intranda/goobi-viewer-core","events":[{"introduced":"17a668c1ef54615132111881af1f7f02c8c86003"},{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"},{"fixed":"330da2f8255a9ed2200ba46b98bb9b6a88748a4e"},{"fixed":"5a59ffa5d76169a4ad3cc396023ad4a4eca217da"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"23.03"},{"fixed":"26.05"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"330da2f8255a9ed2200ba46b98bb9b6a88748a4e"}]},{"range":[{"fixed":"5a59ffa5d76169a4ad3cc396023ad4a4eca217da"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v26.05","range":[{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"}],"source":"REFERENCES_TAG"}]}}],"database_specific":{"vanir_signatures":[{"source":"https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e","target":{"file":"goobi-viewer-core/src/test/java/io/goobi/viewer/solr/SolrToolsTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["155753272986554581499195543406063954601","258372791311626257344576396953479823756","210621050731296146770272549214747825958"]},"id":"CVE-2026-55442-133e52dc","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-55442-2ad86a12","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java","function":"getAdvancedSearchSelectItems"},"deprecated":false,"digest":{"function_hash":"15972731808254145666261176205669785459","length":2933}},{"source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["293943419837386175782308880630292377328","170127000326944715759514306120173437552","223072314872435556758862870822129730388","184713866145576581573500654664532882358","237588089203428832734919670992173305409","280990611135733430789396002312530922372","24011410402069477058498461939093920262","243679154761233145932008628234109855606","21245126937807009457669850870559185657","157573805690410280521963065924689943951","49299172231513956195727309028396980246","249794867519244567083176728280977870199","71331133885813258577251813447387200972","231280190624403314206933099108260677099","131064644070503162456003862872168843296","228717970448403275474455688186333628072","147229437546344567055115541779032048353","296771280783092075493187168226162854698","120686590177198208650842153671343843197","185110271319730517681325665849978046676","133072927174758095098837509638475082729","106915568864856288436707486586529388843","160461748305160759432425790653772593920","317668832181560233029467657143735579550","73682667438275365798270958473607512942","249449434883737352069413629640348278192","195647711537184443325539778426838681880","257419450339920369642547725144123517283","112254453685341924447530792146304337784","200506628299564351230936520852436132030","99422724347327295676833174058837105043","141225596712123407189091063186974358645","281192752199487692721550185112564389005","194840973750847596253923718843247966422","336380174445271318603843347024206517237","96952457555478317003593573357220284563","288939005615045911177043736404399404541","328674136467211459900128018005816102742","75851200508167515578606821188405267014","230110937255770512631639417010960709132","243367955632336005134513142238333853843","253728686788632627169401501763323725722","28196279546092511104474535655606889983","240985082911872732109250870253022523110","7405899224190688798808783959628142002","91368197618688457157980371544354479789","158697872569671941832991527465912955348","305106691200856417832257034142201370878","289336218389088023408326258965270312936","32131413311487982245812841291902270705","133528045941229369766499737505022324454","118600259359074066127455075675860467005","277131013592039677111080227322086714878","12132793595964136568255504321677124068","237513637503532782536650314870439478037","203609570456295320982548574336354293445","51906176174227463930981612168786621659","198425266314817376550601752740401743673","239541424654697691920923576302018587810","4477980581229884955895429889103133623","65554406765763519915522339427629544886"]},"id":"CVE-2026-55442-46a7ca97","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-55442-5fe98c02","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/solr/SolrTools.java"},"deprecated":false,"digest":{"line_hashes":["292318736014489239916363703015843933292","33342444948932622885852297362400241110","150627378087297952261201379269681688615","196032133924619831682861796980968469138","229803355209219361778415706561086726371","150154138193598813965628245584495049179","317997783332699702296697415359344748429","59201442135033630141344734281830530591","236988440403550928763929844223715573932","321489826871792755483077617760847687747"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/330da2f8255a9ed2200ba46b98bb9b6a88748a4e","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/solr/SolrTools.java","function":"cleanUpQuery"},"deprecated":false,"digest":{"function_hash":"103515649166144788248541080637830266894","length":248},"id":"CVE-2026-55442-69637866"}],"vanir_signatures_modified":"2026-10-31T07:03:11Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55442.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}