GeoServer, an open‑source geospatial server, has a server‑side request forgery fault linked to XML entity resolution when the ENTITY_RESOLUTION_ALLOWLIST is used. The flaw requires that GeoServer is configured with a proxy base URL that contains no path component or does not end with a trailing slash. Acting on the description, it is inferred that an attacker can send a crafted XML document that causes GeoServer to resolve external entities, resulting in arbitrary outbound requests and potential internal data exposure.

All GeoServer installations on the 2.26.x line before version 2.26.4, or on the 2.27.x line before version 2.27.3, that use the ENTITY_RESOLUTION_ALLOWLIST setting and a proxy base URL lacking a path or trailing slash are vulnerable; the setting that triggers the issue is the default since version 2.25.0.

The CVSS score of 6.5 signals moderate severity, while the EPSS score is unavailable, leaving the likelihood of exploitation unknown. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw from outside the network without authentication whenever the instance is reachable; the potential attack path is inferred from the behavior described in the advisory.