Description
GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations. This vulnerability is fixed in 2.26.2 and 2.25.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| geoserver | geoserver | >= 2.26.0, < 2.26.2, < 2.25.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.geoserver:gs-gwc | >= 2.26.0, < 2.26.2 | 2.26.2 | GHSA-jm79-7xhw-6f6f |
| Maven | org.geoserver:gs-gwc | < 2.25.6 | 2.25.6 | GHSA-jm79-7xhw-6f6f |
| Maven | org.geoserver.web:gs-web-app | >= 2.26.0, < 2.26.2 | 2.26.2 | GHSA-jm79-7xhw-6f6f |
| Maven | org.geoserver.web:gs-web-app | < 2.25.6 | 2.25.6 | GHSA-jm79-7xhw-6f6f |
Advisories 1
- WID-SEC-2025-1267 GeoServer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2025