Skip to main content
Apexward Pulse

OSGeo

OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

CVE-2025-58360

What this means

This is rated high severity (8.2 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Geoserver Geoserver is in your estate, and treat that as the priority.

Full vendor description

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.

Scoring and exploitation

8.2/ 10
CVSS 3.1 base scoreHigh

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality; low on availability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityNoneI:N
AvailabilityLowA:L
Elevated attack likelihood (~61.2% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
OSGeo GeoServer

Weaknesses

CWE-611

Affected products ()

  • Geoserver Geoserver
Show the raw CPE strings (1)
  • cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*

References

3 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events