{"schemaVersion":3,"id":"CVE-2025-58175","aliases":["GHSA-x4r9-gmw3-hxww"],"status":"published","duplicateOf":null,"title":null,"description":"GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.","dates":{"published":"2026-06-18T14:31:19.757Z","modified":"2026-06-18T15:26:07.311Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.2,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L","exploitability":5.6,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00287,"percentile":0.19953,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.18399999999999997,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00471},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00287,"percentile":0.19953}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00471,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00287,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00287,"percentile":0.19953}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"},{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference","description":"The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/611.html"},{"id":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/918.html"}],"affected":[{"vendor":"geoserver","product":"org.geoserver:gs-main","name":"org.geoserver:gs-main","label":"org.geoserver:gs-main","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.26.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.27.0, < 2.27.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.26.4 | ≥ 2.27.0, < 2.27.3","eol":null,"hubHref":null},{"vendor":"geoserver","product":"org.geoserver.web:gs-web-app","name":"org.geoserver.web:gs-web-app","label":"org.geoserver.web:gs-web-app","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.26.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.27.0, < 2.27.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.26.4 | ≥ 2.27.0, < 2.27.3","eol":null,"hubHref":null},{"vendor":"org.geoserver","product":"gs-main","name":"org.geoserver:gs-main","label":"gs-main","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.geoserver/gs-main","purlType":"maven","versions":[{"text":"< 2.26.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.27.0, < 2.27.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.26.4 | ≥ 2.27.0, < 2.27.3","eol":null,"hubHref":null},{"vendor":"org.geoserver.web","product":"gs-web-app","name":"org.geoserver.web:gs-web-app","label":"gs-web-app","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.geoserver.web/gs-web-app","purlType":"maven","versions":[{"text":"< 2.26.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.27.0, < 2.27.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.26.4 | ≥ 2.27.0, < 2.27.3","eol":null,"hubHref":null},{"vendor":"osgeo","product":"geoserver","name":"GeoServer","label":"geoserver","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.26.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.27.0, < 2.27.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.26.4 | ≥ 2.27.0, < 2.27.3","eol":null,"hubHref":"/vendor/osgeo/geoserver"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww","label":"github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Mitigation","Vendor Advisory"]},{"url":"https://github.com/geoserver/geoserver/pull/8622","label":"github.com/geoserver/geoserver/pull/8622","hostname":"github.com","tags":["X Refsource MISC","WEB","Issue Tracking","Patch"]},{"url":"https://osgeo-org.atlassian.net/browse/GEOS-11867","label":"osgeo-org.atlassian.net/browse/GEOS-11867","hostname":"osgeo-org.atlassian.net","tags":["X Refsource MISC","Issue Tracking"]},{"url":"https://github.com/geoserver/geoserver","label":"github.com/geoserver/geoserver","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-06-18T14:31:19.757Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-18T15:26:07.311Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:26:17.043Z","stale":false,"partial":false}}