{"id":"CVE-2024-40625","aliases":["EUVD-2025-17667","GHSA-r4hf-r8gj-jgw2"],"status":"published","title":"GeoServer Coverage REST API Allows Server Side Request Forgery","description":"GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00385,"percentile":0.32915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2025-06-10T14:14:59Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"Maven","package":"org.geoserver:gs-rest","fixed_in":["2.26.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","fixed_in":["2.26.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.geoserver:gs-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.geoserver:gs-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0"}]}]}],"products":[{"vendor":"geoserver","product":"geoserver"},{"vendor":"osgeo","product":"geoserver"}],"references":[{"url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web"]},{"url":"https://osgeo-org.atlassian.net/browse/GEOS-11468","tags":["x_refsource_MISC","Issue Tracking","Patch","web"]},{"url":"https://osgeo-org.atlassian.net/browse/GEOS-11717","tags":["x_refsource_MISC","Permissions Required","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40625","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r4hf-r8gj-jgw2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40625.json","tags":["advisory"]},{"url":"https://github.com/geoserver/geoserver","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-40625","title":"GeoServer Coverage REST API Allows Server Side Request Forgery","description":"GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.","status":"published","published":"2025-06-10T14:49:05.368Z","modified":"2025-06-10T14:55:09.694Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:06.811965Z"}],"euvd":[{"id":"EUVD-2025-17667","description":"GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.","status":"published","published":"2025-06-10T14:49:05Z","modified":"2025-06-10T14:55:09Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:26.841647Z"}],"ghsa":[{"id":"GHSA-r4hf-r8gj-jgw2","title":"Coverage REST API Server Side Request Forgery","description":"### Summary\n\nThe Coverage rest api `/workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format}` allow to upload file with a specified url (with {method} equals 'url') with no restrict.\n\n### Details\n\nThe Coverage rest api `/workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format}` allow to upload file with a specified url (with {method} equals 'url'). But this url has not been check with [URL Checks feature](https://docs.geoserver.org/latest/en/user/security/urlchecks.html#url-checks).\n\nFor example, should add the code below to check fileURL:\n\n```java\nURLCheckers.confirm(fileURL)\n```\n\nThe vulnerable code was [RESTUtils.java](https://github.com/geoserver/geoserver/blob/main/src/rest/src/main/java/org/geoserver/rest/util/RESTUtils.java#L176)\n\n### Impact\n\nThis vulnerability presents the opportunity for Server Side Request Forgery.\n\n### References\n\n- https://osgeo-org.atlassian.net/browse/GEOS-11468\n- https://osgeo-org.atlassian.net/browse/GEOS-11717","status":"published","published":"2025-06-10T14:14:59Z","modified":"2025-06-10T15:35:34Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2024-40625","description":"GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.","status":"published","published":"2025-06-10T15:15:23.043Z","modified":"2026-06-17T07:46:11.667Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"CVE-2024-40625","title":"GeoServer Coverage REST API Allows Server Side Request Forgery","description":"GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.","status":"published","published":"2025-06-10T14:49:05.368Z","modified":"2026-10-28T02:31:12.93873649Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"GHSA-r4hf-r8gj-jgw2","title":"Coverage REST API Server Side Request Forgery","description":"### Summary\n\nThe Coverage rest api `/workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format}` allow to upload file with a specified url (with {method} equals 'url') with no restrict.\n\n### Details\n\nThe Coverage rest api `/workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format}` allow to upload file with a specified url (with {method} equals 'url'). But this url has not been check with [URL Checks feature](https://docs.geoserver.org/latest/en/user/security/urlchecks.html#url-checks).\n\nFor example, should add the code below to check fileURL:\n\n```java\nURLCheckers.confirm(fileURL)\n```\n\nThe vulnerable code was [RESTUtils.java](https://github.com/geoserver/geoserver/blob/main/src/rest/src/main/java/org/geoserver/rest/util/RESTUtils.java#L176)\n\n### Impact\n\nThis vulnerability presents the opportunity for Server Side Request Forgery.\n\n### References\n\n- https://osgeo-org.atlassian.net/browse/GEOS-11468\n- https://osgeo-org.atlassian.net/browse/GEOS-11717","status":"published","published":"2025-06-10T14:14:59Z","modified":"2025-06-10T15:35:32Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}