Skip to content
OpenAdvisories

Weakness (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

Base Draft

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it (1 mitigation)

  1. Implementation, System Configuration

    Many XML parsers and validators can be configured to disable external entity expansion.

Source: MITRE CWE-611

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.2
    CVE-2025-58360 Exploited Public exploit EPSS 61%

    GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

    GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific end…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
    KEV Dec 11, 2025