Description
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting (XSS) vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's browser through specially crafted SLD_BODY parameters. This issue has been patched in version 2.25.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| geoserver | geoserver | < 2.25.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.geoserver:gs-wms | < 2.25.0 | 2.25.0 | GHSA-w66h-j855-qr72 |
| Maven | org.geoserver.web:gs-web-app | < 2.25.0 | 2.25.0 | GHSA-w66h-j855-qr72 |
Advisories 1
- WID-SEC-2025-2676 GeoServer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2025