{"id":"CVE-2025-58175","aliases":["GHSA-x4r9-gmw3-hxww"],"title":"GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution","summary":"GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution","severity":"medium","cvss":6.5,"cwe":["CWE-20","CWE-611","CWE-918"],"vendor":"geoserver","product":"org.geoserver.web:gs-web-app","ecosystem":"maven","affected":["org.geoserver.web:gs-web-app <= 2.26.3","org.geoserver:gs-main <= 2.26.3","org.geoserver:gs-main >= 2.27.0, <= 2.27.2","org.geoserver.web:gs-web-app >= 2.27.0, <= 2.27.2"],"patched":["org.geoserver.web:gs-web-app 2.26.4","org.geoserver:gs-main 2.26.4","org.geoserver:gs-main 2.27.3","org.geoserver.web:gs-web-app 2.27.3"],"published":"2026-06-12","updated":"2026-06-12","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x4r9-gmw3-hxww","references":[{"url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww"},{"url":"https://github.com/geoserver/geoserver/pull/8622"},{"url":"https://github.com/advisories/GHSA-x4r9-gmw3-hxww"}],"tags":["ghsa","maven"],"epss":0.00471,"epssPercentile":0.39827,"ingestedAt":"2026-07-07T15:41:59.248Z","slug":"CVE-2025-58175","body":"## Overview\n\n### Summary\nA GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF).\n\n### Details\nThis vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0):\n\n### Impact\nThis vulnerability allows an attacker to cause GeoServer to make requests to an unintended location.\n\n### Workaround\nGeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash (e.g., `https://somesite.org` instead of `https://somesite.org/` or `https://somesite.org/geoserver`). If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.\n\n### Resources\nhttps://osgeo-org.atlassian.net/browse/GEOS-11867\nhttps://github.com/geoserver/geoserver/pull/8622\n\n### Credits:\n-  Le Mau Anh Phong at Verichains Cyber Force\n\n## Affected packages\n\n- `org.geoserver.web:gs-web-app <= 2.26.3`\n- `org.geoserver:gs-main <= 2.26.3`\n- `org.geoserver:gs-main >= 2.27.0, <= 2.27.2`\n- `org.geoserver.web:gs-web-app >= 2.27.0, <= 2.27.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.geoserver.web:gs-web-app 2.26.4`\n- `org.geoserver:gs-main 2.26.4`\n- `org.geoserver:gs-main 2.27.3`\n- `org.geoserver.web:gs-web-app 2.27.3`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}