The Goobi Viewer is a web application that displays digitized material and forwards user‑supplied search strings to Solr. In releases from 23.03 up to the end of 26.04, the helper method SolrTools.cleanUpQuery() is intended to strip Solr local‑parameter syntax ({!...}) from all input. A bug in its regular expression allows an attacker to wrap a valid local parameter in an additional pair of braces ({{!...}}). The outer braces are removed but the inner ! block remains, so the malicious local parameter is passed unchanged to Solr. This flaw permits arbitrary Solr local‑parameter injection, which can be used to bypass query restrictions, retrieve or modify data that should be protected, or alter Solr response behavior. The weakness maps to CWE‑116 (Improper Encoding or Escaping of Special Elements) and CWE‑20 (Improper Input Validation).

The vulnerability exists in intranda Goobi Viewer Core from version 23.03 through 26.04, inclusive. Any endpoint that routes user input through cleanUpQuery() is affected. The issue was addressed in the 26.05 release, which removes the faulty regex and restores proper sanitization. Customers running any of the vulnerable releases should identify if the viewer is exposed to Solr queries and plan to update accordingly.

The CVSS score of 5.3 indicates a moderate severity. No EPSS data is available, and the flaw is not listed in CISA’s KEV catalog. The attack vector is web‑based; an attacker can supply a crafted query string to a vulnerable Goobi endpoint, enabling the injection of Solr local parameters. If exploited, an attacker could bypass authorization controls, extract sensitive data, or manipulate Solr indices. The overall risk to affected organizations remains moderate, warranting timely remediation.