medium5.3
CVE-2025-27505
GeoServer Missing Authorization on REST API Index
Impact
### Summary It is possible to bypass the default REST API security and access the index page. ### Details The REST API security handles `rest` and its subpaths but not `rest` with an extension (e.g., `rest.html`). ### Impact The REST API index can disclose whether certain extensions are installed. ### Workaround In `${GEOSERVER_DATA_DIR}/security/config.xml`, change the paths for the `rest` filter to `/rest.*,/rest/**` and change the paths for the `gwc` filter to `/gwc/rest.*,/gwc/rest/**` and restart GeoServer. ### References https://osgeo-org.atlassian.net/browse/GEOS-11664 https://osgeo-org.atlassian.net/browse/GEOS-11776 https://github.com/geoserver/geoserver/pull/8170
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.geoserver.web:gs-web-app | >= 2.26.0, < 2.26.3 | 2.26.3 |
| maven | org.geoserver:gs-rest | >= 2.26.0, < 2.26.3 | 2.26.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Osgeo | Geoserver | before 2.25.6 from 2.26.0 before 2.26.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/geoserver/geoserver/pull/8170
- https://github.com/geoserver/geoserver/security/advisories/GHSA-h86g-x8mm-78m5
- https://osgeo-org.atlassian.net/browse/GEOS-11664
- https://osgeo-org.atlassian.net/browse/GEOS-11776
- https://github.com/advisories/GHSA-h86g-x8mm-78m5
- https://nvd.nist.gov/vuln/detail/CVE-2025-27505