High severity7.3NVD Advisory· Published Sep 8, 2026

CVE-2026-86806

Description

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.

Affected products

Opengeos/Geolibrereferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=2.3.0

Patches

Vulnerability mechanics

References

github.com/opengeos/GeoLibre/commit/b745f62e29fa37364686525a21eee5e5c0f8a369nvd
github.com/opengeos/GeoLibre/issues/1573nvd
github.com/opengeos/GeoLibre/pull/1571nvd
github.com/opengeos/GeoLibre/releases/tag/v2.4.0nvd
vuldb.com/cve/CVE-2026-86806nvd
vuldb.com/submit/911055nvd
vuldb.com/vuln/399812nvd
vuldb.com/vuln/399812/ctinvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000