TI-2025-35983 Aliases CVE-2025-58175 GHSA-x4r9-gmw3-hxww

GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

LOW 35CWE-20Published 2026-06-18 · Updated 2026-06-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00287 21st percentileScored 2026-11-07

Fix Fixed org.geoserver.web:gs-web-app (geoserver): 2.26.4, 2.27.3org.geoserver:gs-main (geoserver): 2.26.4, 2.27.3+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
geoserver	org.geoserver.web:gs-web-app	before 2.26.4; 2.27.0 to before 2.27.3	2.26.4, 2.27.3	Patch available	CNA
geoserver	org.geoserver:gs-main	before 2.26.4; 2.27.0 to before 2.27.3	2.26.4, 2.27.3	Patch available	CNA
—	org.geoserver.web:gs-web-app (Maven)	before 2.26.4	2.26.4	Patch available	GHSA-x4r9-gmw3-hxww
—	org.geoserver:gs-main (Maven)	before 2.26.4	2.26.4	Patch available	GHSA-x4r9-gmw3-hxww
—	org.geoserver:gs-main (Maven)	2.27.0 to before 2.27.3	2.27.3	Patch available	GHSA-x4r9-gmw3-hxww
—	org.geoserver.web:gs-web-app (Maven)	2.27.0 to before 2.27.3	2.27.3	Patch available	GHSA-x4r9-gmw3-hxww

org.geoserver.web:gs-web-app Vendorgeoserver Affected before 2.26.4; 2.27.0 to before 2.27.3 Fixed in 2.26.4, 2.27.3 Patch available CNA
org.geoserver:gs-main Vendorgeoserver Affected before 2.26.4; 2.27.0 to before 2.27.3 Fixed in 2.26.4, 2.27.3 Patch available CNA
org.geoserver.web:gs-web-app (Maven) Vendor— Affected before 2.26.4 Fixed in 2.26.4 Patch available GHSA-x4r9-gmw3-hxww
org.geoserver:gs-main (Maven) Vendor— Affected before 2.26.4 Fixed in 2.26.4 Patch available GHSA-x4r9-gmw3-hxww
org.geoserver:gs-main (Maven) Vendor— Affected 2.27.0 to before 2.27.3 Fixed in 2.27.3 Patch available GHSA-x4r9-gmw3-hxww
org.geoserver.web:gs-web-app (Maven) Vendor— Affected 2.27.0 to before 2.27.3 Fixed in 2.27.3 Patch available GHSA-x4r9-gmw3-hxww

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:osgeo:geoserver::::::::	before 2.26.4; 2.27.0 to before 2.27.3	Vulnerable	OSGeo

cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:* Versions before 2.26.4; 2.27.0 to before 2.27.3 Vulnerable ·OSGeo

Remediation

Fix · CNA org.geoserver.web:gs-web-app (geoserver) Fixed in 2.26.4, 2.27.3
Fix · CNA org.geoserver:gs-main (geoserver) Fixed in 2.26.4, 2.27.3
Fix · GHSA-x4r9-gmw3-hxww org.geoserver.web:gs-web-app (Maven) Fixed in 2.26.4 Advisory →
Fix · GHSA-x4r9-gmw3-hxww org.geoserver:gs-main (Maven) Fixed in 2.26.4 Advisory →
Fix · GHSA-x4r9-gmw3-hxww org.geoserver:gs-main (Maven) Fixed in 2.27.3 Advisory →
Fix · GHSA-x4r9-gmw3-hxww org.geoserver.web:gs-web-app (Maven) Fixed in 2.27.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-58175
2026-10-03 Alias added: GHSA-x4r9-gmw3-hxww

References

Patch 1

https://github.com/geoserver/geoserver/pull/8622

Advisory 1

https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww

Other 2

TI-2024-24187 Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver KEVCVSS 3.1CRITICAL 9.8
TI-2025-36149 GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature KEVCVSS 3.1CRITICAL 9.8
TI-2023-10619 Unfiltered SQL Injection Vulnerabilities in Geoserver CVSS 3.1CRITICAL 9.8
TI-2023-23486 WPS Server Side Request Forgery in GeoServer CVSS 3.1CRITICAL 9.8
TI-2023-17518 GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code… CVSS 3.1CRITICAL 9.8
TI-2025-21556 GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling CVSS 3.1CRITICAL 9.9

See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences