CVE-2026-86806

Deferred Deferred - Pending Action

Server-Side Request Forgery in GeoLibre

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: VulDB

Description

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86806

Affected Vendors & Products

Vendor	Product	Version / Range
opengeos	geolibre	to 2.3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in GeoLibre up to version 2.3.0. It occurs in the _is_within_roots function due to improper path sandboxing when the GEOLIBRE_CONVERSION_ROOTS environment variable is unset. This allows attackers to bypass security checks and send malicious requests to endpoints, enabling arbitrary file read and write operations on the host filesystem.

Detection Guidance

To detect this SSRF vulnerability in GeoLibre, check if the GEOLIBRE_CONVERSION_ROOTS environment variable is unset or misconfigured. Inspect the FastAPI sidecar logs for unusual POST requests to conversion, raster, or vector endpoints with malicious input_path or output_path parameters. Verify if the _is_within_roots() function incorrectly returns True for all file paths.

Impact Analysis

An attacker could exploit this to read sensitive files on the server, write malicious files, or perform unauthorized actions. This could lead to data breaches, system compromise, or further network infiltration if the server has access to internal resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade GeoLibre to version 2.4.0 or later. Set the GEOLIBRE_CONVERSION_ROOTS environment variable to restrict file access. Ensure the GEOLIBRE_SIDECAR_TOKEN is enforced in production environments. Validate PostGIS connections using the GEOLIBRE_POSTGIS_HOSTS allowlist to prevent unauthorized host access.

Hi! I’m here to help you understand CVE-2026-86806. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70