CVE-2026-86806

    Dashboard / Vulnerabilities / CVE-2026-86806

    CVE-2026-86806

    Published: 8 Sept 2026Last Modified: 11 Sept 2026

    Summary: opengeos GeoLibre _is_within_roots server-side request forgery

    Details: A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.

    References: https://github.com/opengeos/GeoLibre/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86806.json, https://nvd.nist.gov/vuln/detail/CVE-2026-86806, https://vuldb.com/cve/CVE-2026-86806, https://vuldb.com/submit/911055, https://vuldb.com/vuln/399812, https://github.com/opengeos/GeoLibre/issues/1573, https://vuldb.com/vuln/399812/cti, https://github.com/opengeos/GeoLibre/commit/b745f62e29fa37364686525a21eee5e5c0f8a369, https://github.com/opengeos/GeoLibre/pull/1571, https://github.com/opengeos/GeoLibre/releases/tag/v2.4.0

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 40afc031c29801f4333a21754f8c9c6c77267b96
    Fixed -b745f62e29fa37364686525a21eee5e5c0f8a369

    Affected versions

    2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86806 | CVE-DB