CVE-2025-58175: GeoServer SSRF in XML entity resolution via proxy base URL bypass

CVE-2025-58175 · Severity: medium · CVSS 6.5 · Published 2026-06-18

GeoServer is an open-source platform used to share, process, and edit geospatial data and maps. A security vulnerability in how the server handles external data requests could allow an unauthenticated attacker to trick the server into making unauthorized connections to internal or external systems. This could lead to the exposure of sensitive internal information or be used to probe private network infrastructure.

Technologies: GeoServer Gs-Main, org.geoserver:gs-main (Maven), org.geoserver.web:gs-web-app (Maven), OSGeo GeoServer. Vendors: GeoServer, Maven, OSGeo.

Quick answers

Is CVE-2025-58175 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-58175 being exploited in the wild.
How severe is CVE-2025-58175?
Medium severity, with a CVSS score of 6.5, published 18 June 2026.
Which products and versions are affected?
GeoServer Gs-Main < 2.26.4, >= 2.27.0, < 2.27.3; GeoServer Gs-Web-App < 2.26.4, >= 2.27.0, < 2.27.3; org.geoserver:gs-main (Maven) ECOSYSTEM:introduced=0,fixed=2.26.4; org.geoserver.web:gs-web-app (Maven) ECOSYSTEM:introduced=0,fixed=2.26.4; and 1 more.
Is there a fix for CVE-2025-58175?
Yes. org.geoserver:gs-main (Maven): upgrade to 2.26.4 or later; org.geoserver.web:gs-web-app (Maven): upgrade to 2.26.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-58175 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-58175?
Check whether you run GeoServer Gs-Main, GeoServer Gs-Web-App, org.geoserver:gs-main (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.geoserver:gs-main (Maven): upgrade to 2.26.4 or later
    # set org.geoserver:gs-main to 2.26.4 in your pom.xml or build.gradle
  • org.geoserver.web:gs-web-app (Maven): upgrade to 2.26.4 or later
    # set org.geoserver.web:gs-web-app to 2.26.4 in your pom.xml or build.gradle

Technical details

An SSRF vulnerability exists in GeoServer's XML entity resolution mechanism. The flaw occurs when GeoServer is configured to use a proxy base URL and the ENTITY_RESOLUTION_ALLOWLIST (enabled by default since version 2.25.0). Specifically, if the proxy base URL lacks a trailing slash or a URL path, the validation logic can be bypassed, allowing unauthenticated attackers to perform SSRF. This is rooted in improper input validation (CWE-20) and improper restriction of XML external entities (CWE-611). The vulnerability is addressed in versions 2.26.4 and 2.27.3. A manual mitigation involves ensuring the proxy base URL ends with a trailing slash.

Affected products

  • GeoServer gs-web-app < 2.26.4, >= 2.27.0, < 2.27.3
  • GeoServer gs-main < 2.26.4, >= 2.27.0, < 2.27.3

Identifiers

  • CVE-2025-58175
  • GHSA-x4r9-gmw3-hxww

Timeline

  • 2025-06-18: disclosed: Initial pull request for fix submitted
  • 2026-06-11: advisory: GitHub Security Advisory published
  • 2026-06-18: patched: NVD record published and versions 2.26.4/2.27.3 confirmed as fixed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.