vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-86806

opengeos GeoLibre _is_within_roots server-side request forgery

HIGH
7.3
CVSS Score
Published: September 8, 2026 at 07:15 PM UTC
Updated: September 9, 2026 at 05:27 PM UTC
1 product affected across 1 vendorGeoLibre

Using GeoLibre by opengeos?

Get instant alerts when new vulnerabilities affect GeoLibre - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.3
Exploit prediction
EPSS 0.6%
SSVC
No known exploit

Description

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

GeoLibre· Opengeos
60%
2.02.12.22.3.0
Vendor states this is fixed in 2.4.0 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (9)

VDB EntryTechnical Description
Source: cverecord
https://vuldb.com/vuln/399812
SignaturePermissions Required
Source: cverecord
https://vuldb.com/vuln/399812/cti
Third Party Advisory
Source: cverecord
https://vuldb.com/cve/CVE-2026-86806
Third Party Advisory
Source: cverecord
https://vuldb.com/submit/911055
Issue Tracking
Source: cverecord
https://github.com/opengeos/GeoLibre/issues/1573
Issue TrackingPatch
Source: cverecord
https://github.com/opengeos/GeoLibre/pull/1571
Patch
Source: cverecord
https://github.com/opengeos/GeoLibre/commit/b745f62e29fa37364686525a21eee5e5c0f8a369
Patch
Source: cverecord
https://github.com/opengeos/GeoLibre/releases/tag/v2.4.0

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.3HIGHVulDB
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-918

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card