CVE-2025-58175

GeoServer prior to versions 2.26.4 and 2.27.3 is affected when it uses ENTITY_RESOLUTION_ALLOWLIST and is configured with a proxy base URL that lacks a URL path or ends without a slash. This can allow unauthenticated Server-Side Request Forgery (SSRF). The vulnerability is mitigated if the proxy ...