Intranda vulnerabilities
We track 6 vulnerabilities in Intranda products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest Intranda vulnerabilities
- 9.3 Critical severity
goobi-viewer-core: Improper Neutralization of Input During Web Page Generation
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query paramet
- 7.4 High severity
goobi-viewer-core: Improper Authentication
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build()
- 7.4 High severity
goobi-viewer-core: Improper Authentication
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares
- 9.8 Critical severity
goobi-viewer-core: Improper Limitation of a Pathname to a Restricted Directory
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Dispositio
- 9.8 Critical severity
goobi-viewer-core: Missing Authentication for Critical Functionality
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts downloa
- 9.8 Critical severity
goobi-viewer-core: Missing Authentication for Critical Functionality
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi viewer REST endpoint POST /api/v1/index/stream accepted an arbitrary Solr streaming expression from unauthenticated n