GeoServer CVE-2025-58175

The target must be running a vulnerable GeoServer build (≤2.26.3 or 2.27.0-2.27.2) with the ENTITY_RESOLUTION_ALLOWLIST mechanism active (default behavior since 2.25.0) AND must be configured with a proxy base URL that has no URL path component and no trailing slash, for example https://somesite.org rather than https://somesite.org/ or https://somesite.org/geoserver; instances using a path-qualified or slash-terminated proxy base URL are not exploitable. The attack itself requires only network reachability to a GeoServer endpoint that processes XML input and accepts no user interaction (PR:N, UI:N), but the impact is bounded to SSRF - there is no integrity impact and only limited availability impact per the CVSS vector, so realistic damage depends on what internal services the GeoServer host can reach.

Signals diverge sharply: the CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:L) is driven by unauthenticated network access and high confidentiality impact through SSRF-mediated data disclosure, yet EPSS reports only 0.06% (19th percentile) and CISA SSVC marks exploitation as 'none' and 'not automatable' with only 'partial' technical impact, and the CVE is not in CISA KEV. The vulnerability is also gated by a specific deployment quirk - a proxy base URL with no path and no trailing slash - which limits the population of exploitable instances and explains the low real-world exploitation probability. Treat this as a meaningful patch priority for internet-facing GeoServer hosting sensitive internal networks (SSRF into cloud metadata or internal services is realistic), but not an emergency on the level of an actively exploited RCE; the gap between CVSS and SSVC/EPSS reflects conditional rather than universal exploitability.

An unauthenticated attacker submits a crafted WFS/WMS request containing an XML payload whose external entity points to a URL beginning with the victim's proxy base URL string but extended with an attacker-controlled suffix (for example https://victim.example.com.attacker.tld/payload.xsd against a proxy base of https://victim.example.com). GeoServer's AllowListEntityResolver accepts the URI because it starts with the configured prefix and dereferences it, causing the server to make an outbound HTTP request to the attacker host or to internal-only resources reachable from the GeoServer host such as cloud metadata endpoints. No public exploit identified at time of analysis, but the workflow is straightforward given the documented allowlist logic and the public patch diff.