CVE-2026-86806

EUVD-2026-74051
A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/opengeos/GeoLibre/
https://github.com/opengeos/GeoLibre/commit/b745f62e29fa37364686525a21eee5e5c0f8a369
https://github.com/opengeos/GeoLibre/issues/1573
https://github.com/opengeos/GeoLibre/pull/1571
https://github.com/opengeos/GeoLibre/releases/tag/v2.4.0
https://vuldb.com/cve/CVE-2026-86806
https://vuldb.com/submit/911055
https://vuldb.com/vuln/399812
https://vuldb.com/vuln/399812/cti