CVE-2023-25157

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.

• CWE-89
• CWE-89

• https://github.com/geoserver/geoserver/commit/145a8af798590288d270b240235e89c8f0b62e1dPatch
• https://github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccfVendor Advisory
• https://github.com/geoserver/geoserver/commit/145a8af798590288d270b240235e89c8f0b62e1dPatch
• https://github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccfVendor Advisory

Published

Feb 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25151opentelemetry-go-contrib is a collection of extensions for O…7.5
• CVE-2023-25152Wings is Pterodactyl's server control plane. Affected versio…8.8
• CVE-2023-25153containerd is an open source container runtime. Before versi…5.5
• CVE-2023-25154Misskey is an open source, decentralized social media platfo…6.1
• CVE-2023-25155Redis is an in-memory database that persists on disk. Authen…6.5
• CVE-2023-25156Kiwi TCMS, an open source test management system, does not i…9.8
• CVE-2023-25158GeoTools is an open source Java library that provides tools …9.8
• CVE-2023-25159Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2023-2516Cross-site Scripting (XSS) - Stored in GitHub repository nil…5.4
• CVE-2023-25160Nextcloud Mail is an email app for the Nextcloud home server…5.3
• CVE-2023-25161Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2023-25162Nextcloud Server is the file server software for Nextcloud, …5.3