cveboard RSS feed

CVE-2025-58175

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

org.geoserver.web:gs-web-app

Vendor
geoserver
Product
org.geoserver.web:gs-web-app
Platforms
Unknown
Default status
Unknown
org.geoserver.web:gs-web-app · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
< 2.26.4affectedUnavailableUnavailableUnavailableNone listed
>= 2.27.0, < 2.27.3affectedUnavailableUnavailableUnavailableNone listed

org.geoserver:gs-main

Vendor
geoserver
Product
org.geoserver:gs-main
Platforms
Unknown
Default status
Unknown
org.geoserver:gs-main · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
< 2.26.4affectedUnavailableUnavailableUnavailableNone listed
>= 2.27.0, < 2.27.3affectedUnavailableUnavailableUnavailableNone listed