GeoServer: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 8.2
  CVE-2025-58360 Exploited Public exploit Scanner template EPSS 61%

  GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

  GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific end…

  geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
  Nov 25, 2025

  KEV Dec 11, 2025
• Medium 6.1
  CVE-2025-21621

  GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format

  GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting (XSS) vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute…

  geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
  Nov 25, 2025

Revision history

1. 2025-12-11 #2

   CVE-2025-58360 wird ausgenutzt

2. 2025-11-25 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2025-11-25
  https://github.com/advisories/GHSA-w66h-j855-qr72
• GitHub Advisory Database vom 2025-11-25
  https://github.com/advisories/GHSA-fjf5-xgmq-5525
• CISA KEV: CVE-2025-58360 OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability vom 2025-12-11
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog