CVE-2024-40625 — GeoServer Coverage REST API Allows Server Side Request Forgery
GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{fo…
Published: 2025-06-10 · CVSS: 5.5 · CVSS 3.1
GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7