GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

高 8.2CVE-2025-58175 · GHSA-x4r9-gmw3-hxww · 18/06/2026 公開 · 06/10/2026 更新

要点

CVE-2025-58175 は org.geoserver.web:gs-web-app, org.geoserver:gs-main, geoserver (osgeo) に影響する深刻度「高」 (CVSS 8.2) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.29%（全脆弱性の 21.3% より高い）。
対処：2.27.3, 2.26.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.geoserver.web:gs-web-app Maven	`≥ 2.27.0, < 2.27.3< 2.26.4`	`2.27.32.26.4`
org.geoserver:gs-main Maven	`≥ 2.27.0, < 2.27.3< 2.26.4`	`2.27.32.26.4`
geoserver osgeo	`≥ 2.27.0, < 2.27.3< 2.26.4`	`2.27.32.26.4`

概要

Summary

A GeoServer that uses ENTITY_RESOLUTION_ALLOWLIST may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF).

Details

This vulnerability requires that GeoServer is set up to use a proxy base URL and the ENTITY_RESOLUTION_ALLOWLIST (default since 2.25.0):

Impact

This vulnerability allows an attacker to cause GeoServer to make requests to an unintended location.

Workaround

GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash (e.g., https://somesite.org instead of https://somesite.org/ or https://somesite.org/geoserver). If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

Resources

https://osgeo-org.atlassian.net/browse/GEOS-11867 https://github.com/geoserver/geoserver/pull/8622

Credits:

Le Mau Anh Phong at Verichains Cyber Force

NVD の説明

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.