CVE-2026-46651

Summary

The Goobi viewer's DownloadTaskEndpoint WebSocket endpoint accepts unauthenticated download requests, allowing attackers to trigger arbitrary downloads on behalf of the server without credentials.

Exploitability

Trivial to exploit over the network with no authentication or user interaction required.

Blast radius

An attacker could abuse this to force the server to download and potentially serve malicious content, leading to data exfiltration, server-side request forgery (SSRF), or denial-of-service via resource exhaustion.

Detection

Monitor for WebSocket connection attempts to /tasks/download/monitor.socket from unauthenticated users; look for repeated or high-volume download requests originating without valid session tokens in access logs or WebSocket traffic logs.

Prioritized remediation

Upgrade to goobi-viewer-core version 26.05 or later, which patches the unauthenticated access vulnerability in the DownloadTaskEndpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.