Skip to content
OpenAdvisories

Package · Maven

org.geoserver.web:gs-web-app

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.2
    CVE-2024-45747

    GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

    ### Summary A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server…

    org.geoserver.web:gs-web-app org.geoserver:gs-wms org.geoserver:gs-main Maven
  • High 7.2
    CVE-2025-52465

    GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

    GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file na…

    geoserver org.geoserver.web:gs-web-app org.geoserver.web:gs-web-sec-core org.geoserver.web:gs-web-app Maven
  • High 8.2
    CVE-2025-58360 Exploited Public exploit Scanner template EPSS 61%

    GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

    GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific end…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
    KEV Dec 11, 2025
  • High 7.5
    CVE-2025-30145

    GeoServer has an Infinite Loop Vulnerability in Jiffle process

    GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to t…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
  • High 7.5
    CVE-2024-24749

    Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

    GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass exist…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-gwc Maven
  • High 8.6
    CVE-2023-41339

    Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

    GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an ``sld=<url>`` parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic sty…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven