PT-2025-48086 · Geoserver · Geoserver

Published

2025-11-25

·

Updated

2026-03-22

·

CVE-2025-58360

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions GeoServer versions 2.26.0 through 2.26.1 and versions prior to 2.25.6
Description GeoServer is an open-source server used for sharing and editing geospatial data. A vulnerability exists due to improper restriction of XML external entity references in the WMS GetMap operation. This allows attackers to define external entities within XML requests, potentially leading to unauthorized access to files, Server-Side Request Forgery (SSRF), and denial-of-service conditions. The vulnerability is actively exploited and affects systems with the /geoserver/wms endpoint exposed. Approximately 20,000+ public network exposed assets are affected. The vulnerability allows an attacker to read arbitrary files from the server and potentially enable denial-of-service conditions or internal system access. The vulnerability is exploitable without authentication.
Recommendations Update to GeoServer version 2.25.6, 2.26.3, or 2.27.0.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2025-14710
CVE-2025-58360
GHSA-FJF5-XGMQ-5525

Affected Products

Geoserver