PT-2026-49054 · Maven · Org.Geoserver.Web:Gs-Web-App+1

Published 2026-06-12 · Updated 2026-06-12 · CVE-2025-58175

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

Summary

A GeoServer that uses ENTITY RESOLUTION ALLOWLIST may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF).

Details

This vulnerability requires that GeoServer is set up to use a proxy base URL and the ENTITY RESOLUTION ALLOWLIST (default since 2.25.0):

Impact

This vulnerability allows an attacker to cause GeoServer to make requests to an unintended location.

Workaround

GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash (e.g., https://somesite.org instead of https://somesite.org/ or https://somesite.org/geoserver). If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

Resources

https://osgeo-org.atlassian.net/browse/GEOS-11867 https://github.com/geoserver/geoserver/pull/8622

Credits:

• Le Mau Anh Phong at Verichains Cyber Force

Fix

RCE

XXE

SSRF

Weakness Enumeration

CWE-20

CWE-611

CWE-918

Related Identifiers

CVE-2025-58175

GHSA-X4R9-GMW3-HXWW

Affected Products

Org.Geoserver.Web:Gs-Web-App

Org.Geoserver:Gs-Main

References · 4

• https://osv.dev/vulnerability/GHSA-x4r9-gmw3-hxww · Vendor Advisory
• https://github.com/geoserver/geoserver · Note
• https://github.com/geoserver/geoserver/pull/8622 · Note
• https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww · Note