This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.

I am trying to apply basic authentication in GeoServer but somehow it is not reflecting while consuming the WMS service through OpenLayers. I am accessing it thorough below urls: * http://admin:geoserver@localhost:8080/geoserver/localhost/wms?.. // psw as plain text (GetMap) * http://admin:Z2Vvc2VydmVy@localhost:8080/geoserver/localhost/wms?.. // psw as base64 encrypted. (GetMap) * http://admin:Z2Vvc2VydmVy@localhost:8080/geoserver/wms?request=GetCapabilities //Check for capabilities Either way it is not working. Below are the screen shots from GeoServer : Filter Chain : default chain config (with basic authentication as well) I created a Child role and created a child user with this role, Also I created service access rule as below Please suggest if I am missing anything.

How can I get total featurecount from a WFS service? I need to download all features, 1000 at a time, so I want to know when to stop (Or can I just keep going until the response is empty?) I've tried to find something here, but I dont: https://slwgeo.artdata.slu.se/geoserver/wfs?request=GetCapabilities The service name is: SLW:AllSwedishOccurrences This is the code I'm using which is working but I need to know when to stop. import os from owslib.wfs import WebFeatureService downloadto = '/home/bera/GIS/csvfiler_paging/' wfs1 = WebFeatureService(url=r'https://slwgeo.artdata.slu.se/geoserver/wfs?', version='1.1.0') wfs1.timeout=120 for i in range(0, 10000, 1000): #I need to replace 10000 with the total feature count print(i) response = wfs1.getfeature(typename='SLW:AllSwedishOccurrences', maxfeatures=1000, outputFormat='csv', startindex=i) outfile=os.path.join(downloadto,'data_{0}.csv'.format(str(i))) out=open(outfile, 'wb') out.write(response.read()) out.close()

If you have built an application with an interactive map, you know what you are in for. You pick a tile provider such as Google or Mapbox, or a self-hosted stack like GeoServer or Martin, and your fro...

If you have built an application with an interactive map, you know what you are in for. You pick a tile provider such as Google or Mapbox, or a self-hosted stack like GeoServer or Martin, and your fro...

If you have built an application with an interactive map, you know what you are in for. You pick a tile provider such as Google or Mapbox, or a self-hosted stack like GeoServer or Martin, and your frontend requests thousands of small image or vector tiles as the user interacts with the map. A server processes each request: it reads from a database, renders the tile, maybe caches it, and sends it back. That server is infrastructure: it needs to be deployed, monitored, and scaled.

I've got several layers in GeoServer, one of which I'm trying to use as a WMS in desktop programs (Manifold 8). I've set it up correctly, but whenever I bring it into Manifold, it projects the layer into EPSG:4326, which unfortunately can't work with my map - I need it in EPSG:3857. The layer in question is wrapped inside a more overarching layer definition, which contains all the layers - and coordinate systems that allow them all to be used flexibly. However, I want to put this layer on its own in the capabilities document, and only allow it to use EPSG:3857. How, in GeoServer, would I edit, or override, a capabilities document?

2026年10月9日（金）〜 2026年10月12日（月）で開催された FFRI × NFLabs. Cybersecurity Challenge 2026 に参加しました！ジャンルはPentest,Web Exploitation,Malware Analysis,Binary Exploitation,Miscと現実の脅威に沿った内容が多く、どの問題も解き甲斐がありました。今回はその中でも特

The post references a newly disclosed vulnerability, CVE-2025-52465, affecting GeoServer. It involves an arbitrary file write issue that could allow unauthorized file manipulation. The vulnerability is detailed in an external research link provided in the post.

I am already using a filter on every workspace in geoserver (2.28.5). I would like to filter a GetCap request using a keyword, it is supposed to work with the addition of "KEYWORD=keyword" building the request like this : http://localhost:8080/geoserver/namespace/ows?acceptversions=2.0.0&request=GetCapabilities&KEYWORD=keyword and it is not working ! I get all the layers in the specific workspace I request. Is there a way to only get the layers in which the keyword is saved in?

In the GeoServer WMS reference, It is written that the namespace can limit the response to layers. But I didn't find any resources related to the namespace. Can anyone help me to understand what namespace mean? Does it mean workspace? I have tried to put the value of the namespace as my workspace name and also layer_name. Both tries did not work and I am getting the full WMS capabilities. Is there any way to filter our capabilities response to the specific layer?

I want to incorporate the following WFS query URL in ArcGIS Online: https://9.9.9.9:8080/geoserver/workspace/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=workspace:education&filter= amenity school The query above was tested positively. However when adding that to ArcGIS Online the URL requires to be shortened down to 'GetFeature', the layer selection happens via dropdown menu and supposedly the query part goes into 'Add Parameters' doesn't it? Parameter = filter Value = amenity school I also tried to add the workspace/layer declaration as parameter to no avail. The Parameters appear to be ignored because all the GML is parsed unfiltered. What am I missing here? Note: The answer here suggests to tediously sign up to an ESRI developer account but that seems to be from a time where WFS wasen't supported at all.

TL;DR GeoServer maintainers disclosed a CVSS 10 GeoServer Cloud vulnerability in a GitHub Actions workflow. It could have let an outside contributor run code on the build runner and steal repository secrets. The maintainers have removed the workflow and found no sign of abuse. Why This GeoServer Cloud Vulnerability Matters GeoServer is an open source Java server for sharing and editing geospatial data.

Hello We had a cascaded WMS working in 2.28.5. After upgrade to 3.0.1, it is failing to load in a WMS client (QGIS). The remote WMS loads fine in QGIS direct without Geoserver cascading it. It appears to be timing out after a long delay in QGIS. Log includes: Error rendering coverage on the fast path Caused by: org.geoserver.platform.ServiceException: org.apache.hc.core5.http.ConnectionRequestTimeoutException: Timeout deadline: 180000 MILLISECONDS, actual: 180000 MILLISECONDS Caused by: org....