~ / search / GHSA-h86g-x8mm-78m5

GHSA-h86g-x8mm-78m5

GeoServer Missing Authorization on REST API Index

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-27505

Packages

EcosystemPackageAffectedFixed in
Maven org.geoserver.web:gs-web-app >= 2.26.0, < 2.26.3 2.26.3
Maven org.geoserver.web:gs-web-app < 2.25.6 2.25.6
Maven org.geoserver:gs-rest >= 2.26.0, < 2.26.3 2.26.3
Maven org.geoserver:gs-rest < 2.25.6 2.25.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary It is possible to bypass the default REST API security and access the index page. ### Details The REST API security handles `rest` and its subpaths but not `rest` with an extension (e.g., `rest.html`). ### Impact The REST API index can disclose whether certain extensions are installed. ### Workaround In `${GEOSERVER_DATA_DIR}/security/config.xml`, change the paths for the `rest` filter to `/rest.*,/rest/**` and change the paths for the `gwc` filter to `/gwc/rest.*,/gwc/rest/**` and restart GeoServer. ### References https://osgeo-org.atlassian.net/browse/GEOS-11664 https://osgeo-org.atlassian.net/browse/GEOS-11776 https://github.com/geoserver/geoserver/pull/8170

References

External links from the advisory. They lead to third-party sites.