GitHub Advisoryadvisory · Maven

GHSA-h86g-x8mm-78m5 GeoServer Missing Authorization on REST API Index

MEDIUM Published 2025-06-10 Modified 2025-06-10 Official page ↗
Aliases
CVE-2025-27505
Ecosystem
Maven
Packages
org.geoserver.web:gs-web-app, org.geoserver:gs-rest
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2025-06-10

Affected packages

• Maven org.geoserver.web:gs-web-app: >= 2.26.0, < 2.26.3 → fixed in 2.26.3 • Maven org.geoserver.web:gs-web-app: < 2.25.6 → fixed in 2.25.6 • Maven org.geoserver:gs-rest: >= 2.26.0, < 2.26.3 → fixed in 2.26.3 • Maven org.geoserver:gs-rest: < 2.25.6 → fixed in 2.25.6

Description

Summary It is possible to bypass the default REST API security and access the index page. Details The REST API security handles `rest` and its subpaths but not `rest` with an extension (e.g., `rest.html`). Impact The REST API index can disclose whether certain extensions are installed. Workaround In `${GEOSERVER_DATA_DIR}/security/config.xml`, change the paths for the `rest` filter to `/rest.*,/rest/**` and change the paths for the `gwc` filter to `/gwc/rest.*,/gwc/rest/**` and restart GeoServer. References https://osgeo-org.atlassian.net/browse/GEOS-11664 https://osgeo-org.atlassian.net/browse/GEOS-11776 https://github.com/geoserver/geoserver/pull/8170

Related

Alias · CVE (1)

  • CVE-2025-27505 GeoServer is an open source server that allows users to share and edit geospatial data. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References