The Goobi viewer contains a WebSocket endpoint (/tasks/download/monitor.socket) that, between versions 24.03 and just before 26.05, accepts download requests from unauthenticated users. Attackers can send crafted messages to this endpoint, causing the server to fetch data from arbitrary URLs (SSRF) or to read local files (LFI). These flaws correspond to CWE‑918, CWE‑552, and the missing authentication weakness (CWE‑306). The resulting data exposure could include sensitive internal address information, document contents, or configuration files, which may aid further attacks.

The vulnerability affects the intranda Goobi viewer core component. All installations running Goobi viewer-core with a release between 24.03 and before 26.05 are impacted. Versions 26.05 and newer contain the fix and are not vulnerable.

The CVSS score of 9.8 places this issue in the high‑risk category. With no EPSS score available, precise exploitation likelihood cannot be determined, but the endpoint is publicly accessible over the network by any unauthenticated client. Attackers could exploit the flaw by sending a WebSocket request to the unprotected endpoint, forcing the server to retrieve data from any URL or local file specified by the attacker. This straightforward attack path underscores the need for immediate remediation.