CVE-2025-58175
HIGH EPSS 20.4%
Published Jun 18, 20261w ago · Modified Jun 22, 20261w ago
8.2 CVSS 3.1
Published Jun 18, 2026 1w ago
Last Modified Jun 22, 2026 1w ago
Description
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability Low
Threat Intelligence
EPSS Exploit Probability
20.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 3
CWE-20 Improper Input Validation Validation
CWE-611
CWE-918 Server-Side Request Forgery (SSRF) Validation
Affected Products 2
References 3
- github.com https://github.com/geoserver/geoserver/pull/8622
- github.com https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww
- osgeo-org.atlassian.net https://osgeo-org.atlassian.net/browse/GEOS-11867
Remediation
- github.com https://github.com/geoserver/geoserver/pull/8622