{"action":"Upgrade org.geoserver:gs-main to 2.26.4 (2.26.x) or 2.27.3 (2.27.x) or later.","affected":[{"fixed":"2.26.4","introduced":"0"},{"fixed":"2.27.3","introduced":"2.27.0"}],"component":"org.geoserver:gs-main","cve_ids":["CVE-2025-58175"],"ecosystem":"Maven","epss":0.00287,"exploited":false,"fixed_versions":["2.26.4","2.27.3"],"ghsa_id":"GHSA-x4r9-gmw3-hxww","id":"tcs_01M5N9HRF4NG4D2QYVBZHSDXS9","modified_at":"2026-06-12T18:41:25.436550Z","published_at":"2026-06-12T18:23:35Z","references":["https://osv.dev/vulnerability/GHSA-x4r9-gmw3-hxww","https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww","https://github.com/geoserver/geoserver/pull/8622","https://github.com/geoserver/geoserver"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-x4r9-gmw3-hxww#Maven/org.geoserver:gs-main","url":"https://osv.dev/vulnerability/GHSA-x4r9-gmw3-hxww"}],"summary":"GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution"}