CVE-2024-40625

—

CVSS 3.1

4.9 medium

EPSS

<1%p27

Published

Jun 10, 2025 (Jun 10, 2025)

Modified

Jun 17, 2026

Description

GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.

Vendors: osgeo
Products: geoserver
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.