Vulnerability · Published Jun 10, 2025 · Assigned by GitHub_M

CVE-2024-40625GeoServer Coverage REST API Allows Server Side Request Forgery

Medium 5.5

In plain English

A medium-severity server-side request forgery in geoserver from geoserver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.4%top 67.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.geoserver.web:gs-web-app	2.26.0	GHSA-r4hf-r8gj-jgw2
Maven	org.geoserver:gs-rest	2.26.0	GHSA-r4hf-r8gj-jgw2

Affected products (as reported)

Vendor	Product	Versions
geoserver	geoserver	< 2.26.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

References

https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2 x_refsource_CONFIRM
https://osgeo-org.atlassian.net/browse/GEOS-11468 x_refsource_MISC
https://osgeo-org.atlassian.net/browse/GEOS-11717 x_refsource_MISC