CVE-2025-58175

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

• CWE-20
• CWE-611
• CWE-918

• https://github.com/geoserver/geoserver/pull/8622Issue Tracking, Patch
• https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxwwMitigation, Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11867Issue Tracking

Published

Jun 18, 2026

Last Modified

Jun 22, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5817The Amazon Products to WooCommerce plugin for WordPress is v…7.2
• CVE-2025-58170Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2025-58171Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2025-58172drawnix is an all in one open-source whiteboard tool. In dra…5.3
• CVE-2025-58173FreshRSS is a self-hosted RSS feed aggregator. In versions 1…8.8
• CVE-2025-58174LDAP Account Manager (LAM) is a webfrontend for managing ent…4.6
• CVE-2025-58176Dive is an open-source MCP Host Desktop Application that ena…8.8
• CVE-2025-58177n8n is an open source workflow automation platform. From 1.2…5.4
• CVE-2025-58178SonarQube Server and Cloud is a static analysis solution for…7.8
• CVE-2025-58179Astro is a web framework for content-driven websites. Versio…6.5
• CVE-2025-5818The Featured Image Plus – Quick & Bulk Edit with Unsplash pl…5.5
• CVE-2025-58180OctoPrint provides a web interface for controlling consumer …8.8