CVE-2025-58175: GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-18 · updated 2026-10-06
Weakness: CWE-20

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

Affected products

geoserver org.geoserver.extension:gs-db2: before 2.26.4; from 2.27.0 before 2.27.3 — fixed in 2.26.4, 2.27.3

How to fix

Upgrade to a fixed version: geoserver org.geoserver.extension:gs-db2 2.26.4, 2.27.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-58175 or the next vulnerability affects your stack