How severe is CVE-2024-24749?

CVE-2024-24749 has a CVSS score of 7.5/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2024-24749?

CVE-2024-24749 affects the following packages: org.geoserver.web:gs-web-app (Maven), org.geoserver.web:gs-web-app (Maven), org.geoserver:gs-gwc (Maven), org.geoserver:gs-gwc (Maven). Ecosystems affected: Maven.

How do I fix CVE-2024-24749?

Update org.geoserver.web:gs-web-app to 2.23.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-24749 is resolved across your whole dependency graph.

How do I detect CVE-2024-24749 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.geoserver.web:gs-web-app, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2024-24749 if there is no patch (or I can't update yet)?

Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Is CVE-2024-24749 actively exploited in the wild?

No public exploit code has been indexed for CVE-2024-24749 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2024-24749?

CVE-2024-24749 has an EPSS (Exploit Prediction Scoring System) score of 0.8%, placing it in the 55th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2024-24749?

CVE-2024-24749 is classified as Path Traversal (CWE-22). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2024-24749 published, and has it been updated?

CVE-2024-24749 was published on July 1, 2024 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕

☕ Maven

Not in CISA KEV

HIGH severity

CVE-2024-24749 — gs-web-app

HIGHFix: GeoWebCache/geowebcache@c7f76bd

CVE-2024-24749 is a high-severity (CVSS 7.5) Path Traversal vulnerability in org.geoserver.web:gs-web-app. A fix is available for org.geoserver.web:gs-web-app — see the affected versions and patch details below.

Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

Also known asGHSA-jhqx-5v5g-mpf3

Published

Jul 1, 2024

Updated

Oct 28, 2026

Affected

4 pkgs

Patched

4 / 4

Exploits

None indexed

Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-24749.

EPSS Exploitation Probability

via FIRST.org ↗

0.8%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs55th percentile — riskier than 55% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

4 pkgs affected

☕org.geoserver.web:gs-web-app☕org.geoserver.web:gs-web-app☕org.geoserver:gs-gwc☕org.geoserver:gs-gwc

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

If GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCache ByteStreamController class and read arbitrary classpath resources with specific file name extensions.

If GeoServer is also deployed as a web archive using the data directory embedded in the geoserver.war file (rather than an external data directory), it will likely be possible to read specific resources to gain administrator privileges. However, it is very unlikely that production environments will be using the embedded data directory since, depending on how GeoServer is deployed, it will be erased and re-installed (which would also reset to the default password) either every time the server restarts or every time a new GeoServer WAR is installed and is therefore difficult to maintain. An external data directory will always be used if GeoServer is running in standalone mode (via an installer or a binary).

Patches

https://github.com/GeoWebCache/geowebcache/pull/1211

Workarounds

Change environment:

Change from Windows operating system. This vulnerability depends on Windows file paths so Linux and Mac OS are not vulnerable.
Change from Apache Tomcat application server. Jetty and WildFly are confirmed to not be vulnerable. Other application servers have not been tested and may be vulnerable.

Disable anonymous access to the embeded GeoWebCache administration and status pages:

Navigate to Security > Authentication Page
Locate Filter Chains heading
Select the web filter filter chain (ant pattern /web/**,/gwc/rest/web/**,/)
Remove ,/gwc/rest/web/** from the pattern (so that /web/**,/ is left).
Save the changes

References

CVE-Pending

Affected Packages

4 total 4 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.geoserver.web:gs-web-app`	all versions	2.23.5`org.geoserver.web:gs-web-app:2.23.5`
☕Maven	`org.geoserver.web:gs-web-app`	≥ 2.24.0&&< 2.24.3	2.24.3`org.geoserver.web:gs-web-app:2.24.3`
☕Maven	`org.geoserver:gs-gwc`	all versions	2.23.5`org.geoserver:gs-gwc:2.23.5`
☕Maven	`org.geoserver:gs-gwc`	≥ 2.24.0&&< 2.24.3	2.24.3`org.geoserver:gs-gwc:2.24.3`

Affected Products

1 product · 2 configurations

Application

geoservergeoserver

≥ 2.24.0 && < 2.24.3

range

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.geoserver.web:gs-web-app, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.geoserver.web:gs-web-app to 2.23.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-24749 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

### Impact If GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCache ByteStreamController class and read arbitrary classpath resources with specific file name extensions. If GeoServer is also deployed as a web archive using the data directory embedded in the geoserver.war file (rather than an external data directory), it will likely be possible to read specific resources to gain administrator privileges. However, it is very unlikely that production environments will be using t