{"id":"GHSA-h86g-x8mm-78m5","summary":"GeoServer Missing Authorization on REST API Index","details":"### Summary\nIt is possible to bypass the default REST API security and access the index page.\n\n### Details\nThe REST API security handles `rest` and its subpaths but not `rest` with an extension (e.g., `rest.html`).\n\n### Impact\nThe REST API index can disclose whether certain extensions are installed.\n\n### Workaround\nIn `${GEOSERVER_DATA_DIR}/security/config.xml`, change the paths for the `rest` filter to `/rest.*,/rest/**` and change the paths for the `gwc` filter to `/gwc/rest.*,/gwc/rest/**` and restart GeoServer.\n\n### References\nhttps://osgeo-org.atlassian.net/browse/GEOS-11664  \nhttps://osgeo-org.atlassian.net/browse/GEOS-11776  \nhttps://github.com/geoserver/geoserver/pull/8170","aliases":["CVE-2025-27505"],"modified":"2025-06-10T19:57:14.859484Z","published":"2025-06-10T19:16:18Z","database_specific":{"github_reviewed_at":"2025-06-10T19:16:18Z","nvd_published_at":"2025-06-10T15:15:23Z","cwe_ids":["CWE-862"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-h86g-x8mm-78m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27505"},{"type":"WEB","url":"https://github.com/geoserver/geoserver/pull/8170"},{"type":"PACKAGE","url":"https://github.com/geoserver/geoserver"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOS-11664"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOS-11776"}],"affected":[{"package":{"name":"org.geoserver.web:gs-web-app","ecosystem":"Maven","purl":"pkg:maven/org.geoserver.web/gs-web-app"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.26.0"},{"fixed":"2.26.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-h86g-x8mm-78m5/GHSA-h86g-x8mm-78m5.json"}},{"package":{"name":"org.geoserver.web:gs-web-app","ecosystem":"Maven","purl":"pkg:maven/org.geoserver.web/gs-web-app"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-h86g-x8mm-78m5/GHSA-h86g-x8mm-78m5.json"}},{"package":{"name":"org.geoserver:gs-rest","ecosystem":"Maven","purl":"pkg:maven/org.geoserver/gs-rest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.26.0"},{"fixed":"2.26.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-h86g-x8mm-78m5/GHSA-h86g-x8mm-78m5.json"}},{"package":{"name":"org.geoserver:gs-rest","ecosystem":"Maven","purl":"pkg:maven/org.geoserver/gs-rest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-h86g-x8mm-78m5/GHSA-h86g-x8mm-78m5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}