GHSA-fjf5-xgmq-5525 CVE-2025-58360
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
- Severity
- 8.2 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 61.17%
- Chance of exploitation in the next 30 days. Higher than 99.16% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Dec 11, 2025
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
- Fix
- Available
- 2 packages have a fixed version
Description
Description
An XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.
An XML External Entity attack is a type of attack that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts.
By exploiting this vulnerability, an attacker can:
- Read arbitrary files from the server's file system.
- Conduct Server-Side Request Forgery (SSRF) to interact with internal systems.
- Execute Denial of Service (DoS) attacks by exhausting resources.
Resolution
Update to GeoServer 2.25.6, GeoServer 2.26.3, or GeoServer 2.27.0.
Impact
The XXE vulnerability can be used to retrieve arbitrary files from the server's file system.
Reference
- https://osgeo-org.atlassian.net/browse/GEOS-11682
- XBOW-024-081
Disclaimer
This vulnerability was detected using XBOW, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.geoserver.web:gs-web-app | >= 2.26.0, < 2.26.2 |
2.26.2 |
| org.geoserver.web:gs-web-app | < 2.25.6 |
2.25.6 |
| org.geoserver:gs-wms | >= 2.26.0, < 2.26.2 |
2.26.2 |
| org.geoserver:gs-wms | < 2.25.6 |
2.25.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.geoserver.web:gs-web-app Maven → 2.26.2
- maven
<dependency><groupId>org.geoserver.web</groupId><artifactId>gs-web-app</artifactId><version>2.26.2</version></dependency>- gradle
implementation("org.geoserver.web:gs-web-app:2.26.2")
org.geoserver:gs-wms Maven → 2.26.2
- maven
<dependency><groupId>org.geoserver</groupId><artifactId>gs-wms</artifactId><version>2.26.2</version></dependency>- gradle
implementation("org.geoserver:gs-wms:2.26.2")
Severity breakdown
CVSS 3.1 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- Low
Weakness
CWE-611: Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
How to prevent it
- Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.
References
Advisories
Packages
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver | Critical Known exploited | Also affects org.geoserver:gs-wms |
| GHSA-wf6j-gr27-g7ch GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates | High | Also affects org.geoserver:gs-wms |
| GHSA-x4r9-gmw3-hxww GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution | High | Also affects org.geoserver.web:gs-web-app |
| GHSA-7qmg-grcp-qf25 GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page | High | Also affects org.geoserver.web:gs-web-app |
| GHSA-w66h-j855-qr72 GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format | Medium | Also affects org.geoserver:gs-wms |
| GHSA-jj54-8f66-c5pc [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service | Critical | Also affects org.geoserver.web:gs-web-app |
| GHSA-gr67-pwcv-76gf GeoServer Infinite Loop Vulnerability in Jiffle process | High | Also affects org.geoserver:gs-wms |
| GHSA-h86g-x8mm-78m5 GeoServer Missing Authorization on REST API Index | Medium | Also affects org.geoserver.web:gs-web-app |
Credits: jodygarnett, xbow-security
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor