Medium severity · published Jun 10, 2025
CVE-2025-27505
GeoServer Missing Authorization on REST API Index
5.3
CVSS
1.2%
EPSS
No
On KEV
Description
GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html). The REST API index can disclose whether certain extensions are installed. This vulnerability is fixed in 2.26.3 and 2.25.6. As a workaround, in ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
geoserver · geoserver
>= 2.26.0, < 2.26.3; < 2.25.6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27505
Patch
https://github.com/geoserver/geoserver/pull/8170
Third Party Advisory
https://github.com/geoserver/geoserver/security/advisories/GHSA-h86g-x8mm-78m5
Issue Tracking
https://osgeo-org.atlassian.net/browse/GEOS-11664
Permissions Required
https://osgeo-org.atlassian.net/browse/GEOS-11776
More from geoserver
9.8
CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
9.8
CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
9.8
CVE-2023-43795
WPS Server Side Request Forgery in GeoServer
9.8
CVE-2023-35042
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as…
9.8
CVE-2023-25157
Unfiltered SQL Injection Vulnerabilities in Geoserver