Medium severity · published Jun 10, 2025
CVE-2024-40625
GeoServer is an open source server that allows users to share and edit geospatial data
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geoserver · Osgeo
before 2.26.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-40625
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-40625
Third Party Advisory
https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2
Issue Tracking
https://osgeo-org.atlassian.net/browse/GEOS-11468
Permissions Required
https://osgeo-org.atlassian.net/browse/GEOS-11717
More from Geoserver
9.8
CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
9.8
CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
9.8
CVE-2023-43795
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data
9.8
CVE-2023-25157
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data
9.1
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data