CVE-2023-51444 is an arbitrary file upload flaw in the GeoServer REST Coverage Store API, rated High (7.2). An authenticated administrator with coverage store permissions can write file contents to arbitrary locations, which can lead to code execution. Upgrade to 2.23.4 or 2.24.1.
What's affected
The GitHub advisory GHSA-9v5q-2gwq-q9hq lists affected packages org.geoserver:gs-platform and org.geoserver:gs-restconfig in versions before 2.23.4 and before 2.24.1. Patched versions are 2.23.4 and 2.24.1. The advisory was published on 19 March 2024. The record gives the same fixed versions.
The record rates it 7.2 (High), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and GitHub also labels it High 7.2. The record's CISA KEV flag is false.
The advisory notes that an administrator with limited privileges could potentially use the flaw to overwrite GeoServer security files and obtain full administrator privileges. That matters if you delegate coverage store management to people who are not full administrators.
How to check if you're exposed
Check the GeoServer version in the web admin About page, or from the files in your deployment. For a WAR deployment, look at the jar names under WEB-INF/lib:
ls WEB-INF/lib | grep -E "gs-main|gs-platform|gs-restconfig"
The version appears in the file names. For containers, check the image tag you run. If you build with Maven, a dependency tree search shows whether your project pulls the two affected artifacts:
mvn dependency:tree | grep -E "gs-platform|gs-restconfig"
Next, review who holds permissions to modify coverage stores through the REST API, and whether the REST interface is reachable from outside trusted networks. Both facts decide how worried to be before you patch.
What to do now
- Upgrade GeoServer to 2.23.4 or 2.24.1 or later, matching your release line.
- Review accounts that can modify coverage stores through the REST Coverage Store API. Remove the permission where it is not needed.
- Restrict the REST API and the admin interface to trusted networks, and make sure default administrator credentials have been changed.
- Check the data directory and server file system for files you cannot explain, especially in locations the GeoServer process can write.
- Run GeoServer as an unprivileged account with write access only where it needs it, so a file write cannot reach system locations.
Why it matters
The record lists CWE-20 (Improper Input Validation) and CWE-434 (Unrestricted Upload of File with Dangerous Type). According to the advisory, coverage stores configured with relative paths use a GeoServer Resource implementation that validates paths to prevent traversal, while stores configured with absolute paths use a different implementation that does not. Two code paths handled the same job with different safety checks.
That inconsistency is a common source of bugs: a protection added to one path is easy to miss in its sibling. The privilege requirement is high, which keeps the score at 7.2, but the impact is code execution and takeover of the server. Treat administrator roles in geospatial platforms with the same care as on any application server.
Quick check
Does an attacker need to be an administrator?
Yes. The advisory describes an authenticated administrator with permission to modify coverage stores. A limited administrator could potentially escalate to full administrator.
How do I know which version is fixed?
The advisory and the record both name 2.23.4 and 2.24.1 as the versions that contain the fix. Use the one for your release line or a later release.
Sources
- GitHub advisory GHSA-9v5q-2gwq-q9hq (fetched)
- GeoServer issue GEOS-11176 (listed in the record, page did not render)
- Gold page for CVE-2023-51444
Last reviewed: 19 October 2026.
