CVE-2025-58360

Published Nov 25, 2025

Last updated a month ago

GeoServer

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-58360 is an XML External Entity (XXE) vulnerability found in GeoServer. The application improperly sanitizes XML input at the `/geoserver/wms` endpoint, specifically within the `GetMap` operation. This allows an attacker to define external entities within an XML request. By exploiting this vulnerability, an attacker can read arbitrary files from the server's file system and conduct Server-Side Request Forgery (SSRF) to interact with internal systems. GeoServer versions before 2.25.6, versions 2.26.0 to before 2.26.3, and versions before 2.27.0 are affected. Users are advised to update to GeoServer 2.25.6, 2.26.3, or 2.27.0 to remediate the vulnerability.

Description: GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
Source: security-advisories@github.com
NVD status: Analyzed
Products: geoserver

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
Exploit added on: Dec 11, 2025
Exploit action due: Jan 1, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security-advisories@github.com: CWE-611

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "929A415A-3926-49DE-855E-9363B5E495D3",
            "versionEndExcluding": "2.25.6"
          },
          {
            "criteria": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "58DCFD5D-914E-442F-AD07-C019C3BDDB2A",
            "versionEndExcluding": "2.26.2",
            "versionStartIncluding": "2.26.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.