CVE-2026-86806

High

Description

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.

SeverityHigh

CVSS7.3

Exploit probability—

ProductOpengeos Geolibre

PublishedSep 8, 2026

First seenSep 8, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Patches

github.com/opengeos/GeoLibre/pull/1571
github.com/opengeos/GeoLibre/commit/b745f62e29fa37364686525a21eee5e5c0f8a369
github.com/opengeos/GeoLibre/releases/tag/v2.4.0

Affected products

Product	Affected versions	Fixed in
opengeos geolibre	2.0, 2.1, 2.2, 2.3.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.