CVE-2023-41877 is a high severity (CVSS 7.2) path traversal flaw in GeoServer, where an administrator can point the log file location at an arbitrary path. The NVD record says no patch existed at publication, while the GitHub advisory lists GeoServer 3.0.0 as patched. Both are explained below.
What's affected
The NVD record says GeoServer 2.23.4 and prior are affected and that, as the issue needs a GeoServer Administrator, "the vulnerability has not received a patch as of time of publication". The GitHub advisory GHSA-8g7v-vjrc-x4g5, which we read, lists the Maven package org.geoserver as affected below 3.0.0 and patched in 3.0.0.
The GitHub advisory says GeoServer 3.0.0 removed the Global Settings option for the log location, so the application parameter GEOSERVER_LOG_LOCATION is the only way to set it.
The record scores the flaw 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. It can be reached over the network, the attack complexity is low, it requires high privileges (an administrator account), and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability high. The weakness class is CWE-22 (path traversal). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
Source conflict: the NVD record says versions 2.23.4 and prior are affected with no patch available, while the GitHub advisory says versions below 3.0.0 are affected and 3.0.0 is patched. Both rate it High at 7.2. Treat any release before 3.0.0 as exposed and use the workaround if you cannot upgrade.
How to check if you're exposed
In the GeoServer admin console, the About and Status pages show the running version. If GeoServer is a Maven dependency in your own build, list it:
mvn dependency:tree -Dincludes=org.geoserver
Also open Global Settings and read the log location value. An unexpected path there is a sign someone changed it. List who holds administrator access to the console.
What to do now
- Read the GeoServer version on every instance and note any before 3.0.0.
- Upgrade to 3.0.0 or later where you can, after reading the upgrade notes.
- Until then, set GEOSERVER_LOG_LOCATION as an environment variable, system property or servlet context parameter. The advisory says this overrides the Global Settings page.
- Limit and review administrator accounts, and keep the admin console off the public internet.
- Check the log location currently configured for anything unexpected.
Why it matters
The weakness is CWE-22, path traversal: a setting that should point only to a log folder can be set to any path. The GitHub advisory says the admin console log page can then show the contents of that file, and that overwriting key GeoServer files could lead to code execution or denial of service.
The vector shows high privileges are needed, and the record notes administrators are often trusted. That is why the maintainers did not patch it for a time. The risk rises with shared admin accounts, so treat the fix as defence in depth.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2023-41877?
The record said none at publication. The GitHub advisory says GeoServer 3.0.0 patches it. Use the newer advisory.
What is the workaround?
Per the advisory, set GEOSERVER_LOG_LOCATION as a system property, environment variable or servlet context parameter so the Global Settings value is not used.
Sources
- GitHub advisory GHSA-8g7v-vjrc-x4g5
- GeoServer global settings documentation (linked from the record; not retrieved)
- CVE-2023-41877 on Gold
Last reviewed: 19 October 2026.
