CVE-2026-86806

6.9 mediumEPSS 0.6%

Medium (6.9). EPSS 0.6% chance of exploitation in the next 30 days.

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-09-08
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://github.com/opengeos/GeoLibre/
https://github.com/opengeos/GeoLibre/commit/b745f62e29fa37364686525a21eee5e5c0f8a369
https://github.com/opengeos/GeoLibre/issues/1573
https://github.com/opengeos/GeoLibre/pull/1571
https://github.com/opengeos/GeoLibre/releases/tag/v2.4.0

Check your stack JSON