-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper path validation in the ByteStreamController. The pre-patch getFileName() method: 1) Used request.getPathInfo() which doesn't account for URL encoding 2) Didn't properly handle Windows path separators (backslashes) 3) Performed substring operations without full URL decoding first. This allowed attackers to bypass validation using Windows-style paths and URL encoding. The patch in PR #1211 specifically addresses these issues by using URLDecoder on the full request URI, normalizing path separators, and implementing stricter path validation checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.geoserver.web:gs-web-app | maven | < 2.23.5 | 2.23.5 |
| org.geoserver.web:gs-web-app | maven | >= 2.24.0, < 2.24.3 | 2.24.3 |
| org.geoserver:gs-gwc | maven | < 2.23.5 | 2.23.5 |
| org.geoserver:gs-gwc | maven | >= 2.24.0, < 2.24.3 | 2.24.3 |