PT-2026-49053 · Geoserver · Geoserver

CVE-2025-52465 · Published 2025-09-02 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.26.4 GeoServer versions prior to 2.27.3

Description An authenticated administrator with access to the security system can provide arbitrary absolute file paths to the Master Password Dump web page to create files containing the master password in plaintext. This occurs because the software performs minimal validation on the provided java.io.File path. Since there is no default maximum password length, an administrator could include malicious code in the password and dump it into a JSP (JavaServer Pages) file. If the environment allows dynamic deployment and execution of JSP files, such as a default Tomcat installation, this can lead to remote code execution. On Windows systems, this may be used to trigger outbound NTLM (New Technology LAN Manager) requests to a remote server to disclose NTLM hashes or passwords. Additionally, the ability to write files to any location where the process has permissions could result in a denial of service.

Recommendations Update to version 2.26.4. Update to version 2.27.3. Disable or completely remove the web interface to mitigate the risk.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

BDU:2026-08880

CVE-2025-52465

GHSA-7QMG-GRCP-QF25

Affected Products

Geoserver

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52465.json · Exploit
• https://github.com/geoserver/geoserver/pull/8584 · Patch
• https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52465 · Security Note
• https://osv.dev/vulnerability/GHSA-7qmg-grcp-qf25 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-08880 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52465 · Vendor Advisory
• https://github.com/geoserver/geoserver · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2026-49053 · Note
• https://partywave.site/show/research/cve-2025-52465-geolocate-geoserver · Note
• https://geoserver.org/announcements/2025/09/01/geoserver-2-26-4-released.html · Note
• https://t.me/cveNotify/173659 · Telegram Post
• https://t.me/defcon_news/136609 · Telegram Post
• https://t.me/RNetsec/23312 · Telegram Post
• https://osgeo-org.atlassian.net/browse/GEOS-11852 · Note