CVE-2026-86806: opengeos GeoLibre _is_within_roots server-side request forgery
A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opengeos GeoLibreto a version that resolves this vulnerability.Fixed in 2.4.0Patch b745f62e29fa37364686525a21eee5e5c0f8a369 - Compensating control
Because the attack can be initiated remotely and causes server-side request forgery, restrict network access to the GeoLibre service so untrusted remote clients cannot reach it directly.
Event History
Frequently Asked Questions
Which deployments are affected?
OpenGeo GeoLibre versions up to and including 2.3.0 are affected.
Does exploitation require authentication or user interaction?
No. The issue can be initiated remotely, and the supplied severity vector indicates no privileges or user interaction are required.
What is the recommended remediation?
Upgrade GeoLibre to version 2.4.0. The associated patch is b745f62e29fa37364686525a21eee5e5c0f8a369.