CVE-2025-58175

HighCVSS 8.2/10Last modified Oct 6, 2026

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-20 CWE-611 CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jun 18, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-581768.8Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. In versions 0.9.0 through 0.9.3, th CVE-2025-581775.4n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerabilit CVE-2025-581787.8SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a comm CVE-2025-581796.5Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare ad CVE-2025-58185.5The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions CVE-2025-581808.8OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerab CVE-2025-581815.3SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker t CVE-2025-581834.3tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted arc CVE-2025-581855.3Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.CVE-2025-581865.3Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very CVE-2025-581877.5Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size CVE-2025-581887.5Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement