Executive brief
GeoLibre is a cloud-native geospatial information system that allows users to visualize and analyze geographic data in web browsers and desktop applications. A server-side request forgery vulnerability in the _is_within_roots function could allow attackers to make unauthorized requests to internal or external resources, potentially exposing sensitive data or enabling lateral movement within networks.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the _is_within_roots function of OpenGEOS GeoLibre up to version 2.3.0. The vulnerability can be exploited remotely without requiring authentication. The root cause appears to be inadequate validation of paths and URLs used in conversion/whitebox operations, allowing attackers to manipulate requests to access unauthorized resources. The fix (commit b745f62e29fa37364686525a21eee5e5c0f8a369, released in version 2.4.0) implements path sandboxing, SSRF egress filtering to block metadata/link-local targets, and enhanced input validation including path traversal checks and URL restrictions.
Affected products
- OpenGEOS GeoLibre up to 2.3.0
Timeline
- 2026-09-08: disclosed: CVE published on NVD
- 2026-07-11: patched: Security fix committed (b745f62e29fa37364686525a21eee5e5c0f8a369), version 2.4.0 recommended