GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
References
| Link | Resource |
|---|---|
| https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525 | Vendor Advisory |
| https://osgeo-org.atlassian.net/browse/GEOS-11682 | Issue Tracking |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-58360 | US Government Resource |
Configurations
Configuration 1 (hide)
|
History
12 Dec 2025, 13:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-58360 - US Government Resource |
11 Dec 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Dec 2025, 14:41
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:* | |
| First Time |
Geoserver geoserver
Geoserver |
|
| References | () https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525 - Vendor Advisory | |
| References | () https://osgeo-org.atlassian.net/browse/GEOS-11682 - Issue Tracking |
25 Nov 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-25 21:15
Updated : 2025-12-12 13:54
NVD link : CVE-2025-58360
Mitre link : CVE-2025-58360
CVE.ORG link : CVE-2025-58360
JSON object : View
Products Affected
geoserver
- geoserver
CWE
CWE-611
Improper Restriction of XML External Entity Reference