CVE-2025-58360highunder attackCWE-611

CVE-2025-58360: high-severity vulnerability in geoserver

GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Published · Updated

Follow this CVE+ Monitor geoserver+ Monitor GeoServer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

98Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.2epss 61%
from disclosure to weapon1 day
Published on NVDNov 25
1st PoC+1d
metasploitNov 25
CISA KEV+16d
Action required by CISAfederal deadline: 2026-01-01

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

GeoServer has a security flaw where attackers can send specially crafted XML requests to the WMS GetMap feature without logging in, potentially reading sensitive files or causing the server to crash. This happens because the application doesn't properly validate XML input.

Technical detail

An unauthenticated attacker can exploit XXE vulnerability via the /geoserver/wms GetMap endpoint by injecting malicious XML entities in requests. The application fails to disable external entity processing, enabling file disclosure, SSRF, or denial of service attacks. Affected versions are 2.26.0–2.26.1 and 2.25.0–2.25.5.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected products
geoserver · geoserver
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — geoserver

In the same product, most dangerous first.

CVE-2024-36401CRITICALRemote Code Execution (RCE) vulnerability in evaluating property name expressions in GeoserverEPSS 99.8%KEVCVE-2023-25157CRITICALUnfiltered SQL Injection Vulnerabilities in GeoserverEPSS 85.2%CVE-2023-43795HIGHWPS Server Side Request Forgery in GeoServerEPSS 69.0%CVE-2025-30220CRITICALGeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handlingEPSS 43.6%CVE-2024-29198HIGHGeoServer Vulnerable to Unauthenticated SSRF via TestWfsPostEPSS 2.3%CVE-2023-51444HIGHGeoServer arbitrary file upload vulnerability in REST Coverage Store APIEPSS 1.9%