Vulnerability · Published Jun 10, 2025 · Assigned by GitHub_M
CVE-2025-27505GeoServer Missing Authorization on REST API Index
Medium 5.3
In plain English
A medium-severity missing authorization in geoserver from geoserver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html). The REST API index can disclose whether certain extensions are installed. This vulnerability is fixed in 2.26.3 and 2.25.6. As a workaround, in ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.geoserver.web:gs-web-app | 2.26.3 | GHSA-h86g-x8mm-78m5 |
| Maven | org.geoserver.web:gs-web-app | 2.25.6 | GHSA-h86g-x8mm-78m5 |
| Maven | org.geoserver:gs-rest | 2.26.3 | GHSA-h86g-x8mm-78m5 |
| Maven | org.geoserver:gs-rest | 2.25.6 | GHSA-h86g-x8mm-78m5 |
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/geoserver/geoserver/security/advisories/GHSA-h86g-x8mm-78m5 x_refsource_CONFIRM
- https://github.com/geoserver/geoserver/pull/8170 x_refsource_MISC
- https://osgeo-org.atlassian.net/browse/GEOS-11664 x_refsource_MISC
- https://osgeo-org.atlassian.net/browse/GEOS-11776 x_refsource_MISC