Medium WID-SEC-2026-1902 3 CVEs

GeoServer: Mehrere Schwachstellen

Published Jun 11, 2026 · Updated Jun 18, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in GeoServer ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

GeoServer ist ein Open-Source-Server zum Teilen von Geodaten.

Vulnerabilities 3

High 7.2

CVE-2025-27511

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Co…

geoserver org.geoserver.extension:gs-db2 org.geoserver.extension:gs-db2 Maven

Jun 18, 2026
High 7.2

CVE-2025-52465

GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file na…

geoserver org.geoserver.web:gs-web-app org.geoserver.web:gs-web-sec-core org.geoserver.web:gs-web-app Maven

Jun 18, 2026
Medium 6.5

CVE-2025-58175

GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). …

geoserver org.geoserver.web:gs-web-app org.geoserver:gs-main org.geoserver.web:gs-web-app Maven

Jun 18, 2026

Revision history

2026-06-18 #2
Referenz(en) aufgenommen: EUVD-2025-210276, EUVD-2025-210278, EUVD-2025-210277
2026-06-11 #1
Initiale Fassung

References

GitHub Security Advisory GHSA-7qmg-grcp-qf25 vom 2026-06-11
https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25
GitHub Security Advisory GHSA-g628-r368-6vh7 vom 2026-06-11
https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7
GitHub Security Advisory GHSA-wf6j-gr27-g7ch vom 2026-06-11
https://github.com/geoserver/geoserver/security/advisories/GHSA-wf6j-gr27-g7ch
GitHub Security Advisory GHSA-x4r9-gmw3-hxww vom 2026-06-11
https://github.com/geoserver/geoserver/security/advisories/GHSA-x4r9-gmw3-hxww