CVE-2025-58175: geoserver before 2.26.4 (exclusive), from 2.27.0 (inclusive), before 2.27.3 (exclusive); +2 more affected products

Affected technology

geoserver · before 2.26.4 (exclusive)
osgeo

geoserver · from 2.27.0 (inclusive), before 2.27.3 (exclusive)
osgeo

org.geoserver.web:gs-web-app · < 2.26.4, >= 2.27.0, < 2.27.3
geoserver

org.geoserver:gs-main · < 2.26.4, >= 2.27.0, < 2.27.3
geoserver

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as high; integrity impact as none; availability impact as low. NVD’s CVSS 3.1 assessment (base score 8.2/10) rates confidentiality impact as high; integrity impact as none; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.