Goobi viewer: Missing authentication in download WebSocket leads to SSRF and file access

Summary

Goobi viewer core versions from 24.03 up to, but not including, 26.05 accept download requests on the DownloadTaskEndpoint WebSocket without authentication. An unauthenticated remote attacker can trigger server-side requests (SSRF) and read certain local files readable by the Tomcat process. The vendor advisory also describes exposure of Solr index metadata and unloading of the Solr core, which makes the viewer unavailable until re-indexing; these impacts were not independently reproduced. No public proof of concept or known exploitation was found at the time of research.

Affected

• intranda goobi-viewer-core, versions 24.03 up to but not including 26.05
• Affected endpoint: /tasks/download/monitor.socket
• NVD status: Deferred; CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) from the CNA

Fixed in

• Fixed in goobi-viewer-core 26.05
• Fix commits: 5281245 and b8943ee

Workaround

• No workaround is needed if you can upgrade to 26.05 or later.
• Interim measure until patched: restrict access to the viewer's WebSocket path at a reverse proxy or firewall. This has not been verified as sufficient.
• Read the vendor advisory GHSA-79jg-3m2m-jgc8 for workaround details before relying on any workaround.

Exploitation

• Known exploitation: none found.
• Public proof of concept: none found.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• A related advisory (GHSA-r386-2frm-w3v6) describes a path traversal in ExternalFilesDownloader that can be chained from this issue; the chain is reported to lead to code execution as the Tomcat user. This is not verified.

Our recommendation

• Identify all goobi-viewer-core instances and confirm the deployed version, including instances run by a service provider.
• Upgrade to version 26.05 or later as a priority, especially internet-facing instances.
• If patching is delayed, restrict access to /tasks/download/monitor.socket and review logs for unexpected download requests.
• Check whether Solr and Tomcat hosts are directly exposed.
• Review the related advisory GHSA-r386-2frm-w3v6 and monitor for public proof of concept releases and KEV updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GHSA-79jg-3m2m-jgc8 Security Advisory github.com
• Release v26.05 github.com
• Fix commit 5281245 (SSRF validation in downloader) github.com
• Fix commit b8943ee (SSRF protection in NetTools) github.com
• Vulners CVE record vulners.com
• VulDB entry vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:41.