CVE-2025-27505

MEDIUM EPSS 59.1%
Published Jun 10, 20251y ago · Modified Jun 17, 20261w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Jun 10, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html). The REST API index can disclose whether certain extensions are installed. This vulnerability is fixed in 2.26.3 and 2.25.6. As a workaround, in ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
59.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 2

VendorProductVersionRange
osgeogeoserver* <2.25.6
osgeogeoserver*≥2.26.0  –  <2.26.3

References 4

  • github.com https://github.com/geoserver/geoserver/pull/8170
    Patch
  • github.com https://github.com/geoserver/geoserver/security/advisories/GHSA-h86g-x8mm-78m5
    Third Party Advisory
  • osgeo-org.atlassian.net https://osgeo-org.atlassian.net/browse/GEOS-11664
    Issue TrackingPatch
  • osgeo-org.atlassian.net https://osgeo-org.atlassian.net/browse/GEOS-11776
    Permissions Required

Remediation