CVE-2025-58175 Details
Description
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.
A server-side request forgery (SSRF) vulnerability has been identified in GeoServer versions prior to 2.26.4 and 2.27.3. This vulnerability arises in installations that use the 'ENTITY_RESOLUTION_ALLOWLIST' feature, which is enabled by default since version 2.25.0. The issue occurs when GeoServer is configured with a proxy base URL that lacks a URL path or does not end with a slash. Under these conditions, an attacker can exploit the vulnerability to make unauthorized requests to internal or external resources via the GeoServer application.
Users can upgrade to GeoServer versions 2.26.4 or 2.27.3 to address this vulnerability. If an immediate upgrade is not possible, GeoServer installations can mitigate the issue by ensuring that the proxy base URL includes a trailing slash or a URL path.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/geoserver/geoserver/pull/8622 | [email protected] | Issue TrackingPatch |
| https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww | [email protected] | MitigationVendor Advisory |
| https://osgeo-org.atlassian.net/browse/GEOS-11867 | [email protected] | Issue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-611 | Improper Restriction of XML External Entity Reference | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| osgeo geoserver | < 2.26.4 >= 2.27.0, < 2.27.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | Initial Analysis | [email protected] |
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |