PT-2026-48799 · Maven · Org.Geoserver.Extension:Gs-Db2

Published 2026-06-11 · Updated 2026-06-11 · CVE-2025-27511

OSV

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution (RCE).

Impact

If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code.

Details

Authenticated users can access Vector Data Sources page to creating a new data store through db2 jdbc connection, performing JNDI attack due to unrestricted connection parameters, and then achieve RCE with deserialization of untrusted data.

Remediation

This issue has been fixed in this release: https://github.com/geoserver/geoserver/releases/tag/2.27.0.

References

• https://osgeo-org.atlassian.net/browse/GEOT-7725
• https://nvd.nist.gov/vuln/detail/cve-2023-27867

Fix

Deserialization of Untrusted Data

Special Elements Injection

Weakness Enumeration

CWE-502

CWE-74

Related Identifiers

CVE-2025-27511

GHSA-G628-R368-6VH7

Affected Products

Org.Geoserver.Extension:Gs-Db2

References · 4

• https://osv.dev/vulnerability/GHSA-g628-r368-6vh7 · Vendor Advisory
• https://github.com/geoserver/geoserver · Note
• https://github.com/geoserver/geoserver/releases/tag/2.27.0 · Note
• https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7 · Note