{"id":"CVE-2023-41877","aliases":["GHSA-8g7v-vjrc-x4g5"],"url":"https://o3.security/vulnerability/CVE-2023-41877","summary":"GeoServer log file path traversal vulnerability","details":"### Impact\n\nThis vulnerability requires GeoServer Administrator with access to the admin console  to misconfigured the **Global Settings** for **log file location** to an arbitrary location.\n\nThis can be used to read files via the admin console **GeoServer Logs** page. It is also possible to leverage RCE or cause denial of service by overwriting key GeoServer files.\n\n### Patches\n\nThis issue has been addressed in GeoServer 3.0.0:\n* The Global Settings page can no longer be used to specify log file location\n* The application parameter ``GEOSERVER_LOG_LOCATION`` mechanism (outlined below) is now the only approach available to customize the log file location.\n\n### Workarounds\n\nA system administrator responsible for running GeoServer can define  the ``GEOSERVER_LOG_FILE`` parameter, preventing the global setting provided from being used.\n\nThe ``GEOSERVER_LOG_LOCATION`` parameter can be set as system property, environment variable, or servlet context parameter.\n\nEnvironmental variable:\n```bash\nexport GEOSERVER_LOG_LOCATION=/var/opt/geoserver/logs\n```\n\nSystem property:\n```bash\n-DGEOSERVER_LOG_LOCATION=/var/opt/geoserver/logs\n```\n\nWeb application ``WEB-INF/web.xml``:\n```xml\n  <context-param>\n    <param-name> GEOSERVER_LOG_LOCATION </param-name>\n    <param-value>/var/opt/geoserver/logs</param-value>\n  </context-param>\n```\n\nTomcat **conf/Catalina/localhost/geoserver.xml**:\n```xml\n<Context>\n  <Parameter name=\"GEOSERVER_LOG_LOCATION\"\n             value=\"/var/opt/geoserver/logs\" override=\"false\"/>\n</Context>\n```\n\n### References\n\n* [Upgrading GeoServer 3](https://docs.geoserver.org/main/en/user/installation/upgrade3/#log-location-configuration)\n* [Log location](https://docs.geoserver.org/latest/en/user/configuration/globalsettings/#logging-settings) (User Manual)","published":"2024-03-20T14:27:34.308Z","modified":"2026-08-12T03:51:47.650301126Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.geoserver:gs-main","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://docs.geoserver.org/latest/en/user/configuration/globalsettings.html#log-location"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41877.json"},{"type":"ADVISORY","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-8g7v-vjrc-x4g5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41877"},{"type":"PACKAGE","url":"https://github.com/geoserver/geoserver"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:47.650301126Z"}}