Executive brief
GeoServer is an open-source platform used to share, process, and edit geospatial data and maps. A security vulnerability in how the server handles external data requests could allow an unauthenticated attacker to trick the server into making unauthorized connections to internal or external systems. This could lead to the exposure of sensitive internal information or be used to probe private network infrastructure.
Technical details
An SSRF vulnerability exists in GeoServer's XML entity resolution mechanism. The flaw occurs when GeoServer is configured to use a proxy base URL and the ENTITY_RESOLUTION_ALLOWLIST (enabled by default since version 2.25.0). Specifically, if the proxy base URL lacks a trailing slash or a URL path, the validation logic can be bypassed, allowing unauthenticated attackers to perform SSRF. This is rooted in improper input validation (CWE-20) and improper restriction of XML external entities (CWE-611). The vulnerability is addressed in versions 2.26.4 and 2.27.3. A manual mitigation involves ensuring the proxy base URL ends with a trailing slash.
Affected products
- GeoServer gs-web-app < 2.26.4, >= 2.27.0, < 2.27.3
- GeoServer gs-main < 2.26.4, >= 2.27.0, < 2.27.3
Timeline
- 2025-06-18: disclosed: Initial pull request for fix submitted
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-18: patched: NVD record published and versions 2.26.4/2.27.3 confirmed as fixed