What is CVE-2025-58175?

CVE-2025-58175 is a medium-severity vulnerability in Geoserver Org.geoserver:gs-Main, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2026-06-18.

How severe is CVE-2025-58175?

Medium severity. CVSS v3 base score is 6.5 out of 10.

XXE in Geoserver Org.geoserver:gs-Main

CVE-2025-58175

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2026-06-18 · last modified 2026-06-22.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L.

EPSS exploit prediction

EPSS: 0.005 (38.3th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 38.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Geoserver Org.geoserver:gs-Main — versions < 2.26.4, >= 2.27.0, < 2.27.3
Geoserver Org.geoserver.web:gs-Web-App — versions < 2.26.4, >= 2.27.0, < 2.27.3
Osgeo Geoserver

Weakness classification (CWE)

References

github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww (Mitigation, Vendor Advisory)
github.com/geoserver/geoserver/pull/8622 (Patch, Issue Tracking)
osgeo-org.atlassian.net/browse/GEOS-11867 (Issue Tracking)

Frequently asked questions

What is CVE-2025-58175?: CVE-2025-58175 is a medium-severity vulnerability in Geoserver Org.geoserver:gs-Main, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2026-06-18.
How severe is CVE-2025-58175?: Medium severity. CVSS v3 base score is 6.5 out of 10.