CVE-2023-41877

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location to an arbitrary location. The admin console GeoServer Logs page provides a preview of these contents. As this issue requires GeoServer administrators access, often representing a trusted party, the vulnerability has not received a patch as of time of publication. As a workaround, a system administrator responsible for running GeoServer can use the `GEOSERVER_LOG_FILE` setting to override any configuration option provided by the Global Settings page. The `GEOSERVER_LOG_LOCATION` parameter can be set as system property, environment variables, or servlet context parameters.

• CWE-22
• CWE-22

• https://docs.geoserver.org/latest/en/user/configuration/globalsettings.html#log-locationProduct
• https://github.com/geoserver/geoserver/security/advisories/GHSA-8g7v-vjrc-x4g5Mitigation, Vendor Advisory
• https://docs.geoserver.org/latest/en/user/configuration/globalsettings.html#log-locationProduct
• https://github.com/geoserver/geoserver/security/advisories/GHSA-8g7v-vjrc-x4g5Mitigation, Vendor Advisory

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41871Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-41872Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-41873Missing Authorization vulnerability in miniOrange SAML SP Si…4.3
• CVE-2023-41874Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-41875Missing Authorization vulnerability in wpdirectorykit.com WP…9.8
• CVE-2023-41876Cross-Site Request Forgery (CSRF) vulnerability in Hardik Ka…8.8
• CVE-2023-41878MeterSphere is a one-stop open source continuous testing pla…9.8
• CVE-2023-41879Magento LTS is the official OpenMage LTS codebase. Guest ord…7.5
• CVE-2023-4188 SQL Injection in GitHub repository instantsoft/icms2 prior …9.1
• CVE-2023-41880Wasmtime is a standalone runtime for WebAssembly. Wasmtime v…5.3
• CVE-2023-41881vantage6 is privacy preserving federated learning infrastruc…4.3
• CVE-2023-41882vantage6 is privacy preserving federated learning infrastruc…4.3