PT-2026-122126

CVE-2026-46651

·

Published

2026-10-23

·

Updated

2026-10-23

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-552: Files or Directories Accessible to External Parties
CWE-306: Missing Authentication for Critical Function
CWE-918: Server-Side Request Forgery (SSRF)
Related identifiers
CVE-2026-46651
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com