Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

geoserver/geoserver

              main @ b72a8a1
            

143

Fixes

CVEs

CRITICAL

Peak severity

27.5%

Coverage

Highlights

Auth Bypass: 46 prior fixes. Scrutinize any change in this area.

GeoServerSecurityManager: most-fixed (4 issues). Treat as high-risk during review.

107 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address catalog access control bypasses, including bulk getters, layer groups, mixed-mode behavior, and null filters, indicating a high-risk area where unauthorized resource disclosure is likely.

Auth Bypass: Several fixes correct filter logic in the default resource access manager, affecting layer/workspace access decisions. Incorrect filters can grant unauthorized access to layers or workspaces.

XXE: The central XXE protection has been bypassed multiple times, including case-sensitivity and file:// .xsd exceptions, indicating that XML parsers across the codebase remain at risk if the resolver is not consistently applied.