Coverage REST API Server Side Request Forgery
Summary
The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allow to upload file with a specified url (with {method} equals 'url') with no restrict.
Details
The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allow to upload file with a specified url (with {method} equals 'url'). But this url has not been check with URL Checks feature.
For example, should add the code below to check fileURL:
URLCheckers.confirm(fileURL)The vulnerable code was RESTUtils.java
Impact
This vulnerability presents the opportunity for Server Side Request Forgery.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.geoserver:gs-rest | < 2.26.0 | 2.26.0 |
| Java / Kotlin (Maven) | org.geoserver.web:gs-web-app | < 2.26.0 | 2.26.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L- Weakness (CWE)
CWE-918- Platform
- Java / Kotlin (Maven)
- Package
org.geoserver:gs-rest, org.geoserver.web:gs-web-app- Disclosed
- 10.06.2025
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-r4hf-r8gj-jgw2 - CC BY 4.0
Vulnerability history: org.geoserver:gs-rest
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 06.2025 06.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2025: 2
- 2026: 0
-
Coverage REST API Server Side Request Forgery this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.