Description
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| geoserver | geoserver | >= 2.26.0, < 2.26.2, < 2.25.6 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
GeoServer WMS GetMap XXE Arbitrary File Read
auxiliary/gather/geoserver_wms_getmap_xxe_file_read
GitHub 6 repositories
-
quyenheu/CVE-2025-58360 ★ 7 · Nov 27, 2025
XXE through a specific endpoint /geoserver/wms operation GetMap - Geoserver
-
thomas-osgood/cve-2025-58360 ★ 1 · Feb 2, 2026
-
quyenheu/Bypass-CVE-2025-58360 ★ 1 · Dec 31, 2025
A new way to exploit CVE-2025-58360 bypass WAF
-
rxerium/CVE-2025-58360 ★ 0 · Dec 12, 2025
Passive detection for CVE-2025-58360
-
Joker-Wiggin/CVE-2025-58360-GeoServer-XXE ★ 0 · Dec 12, 2025
-
carlzhang123/Blackash-CVE-2025-58360 ★ 0 · Nov 27, 2025
CVE-2025-58360
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- GeoServer - XML External Entity Injection http/cves/2025/CVE-2025-58360.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.geoserver:gs-wms | >= 2.26.0, < 2.26.2 | 2.26.2 | GHSA-fjf5-xgmq-5525 |
| Maven | org.geoserver:gs-wms | < 2.25.6 | 2.25.6 | GHSA-fjf5-xgmq-5525 |
| Maven | org.geoserver.web:gs-web-app | >= 2.26.0, < 2.26.2 | 2.26.2 | GHSA-fjf5-xgmq-5525 |
| Maven | org.geoserver.web:gs-web-app | < 2.25.6 | 2.25.6 | GHSA-fjf5-xgmq-5525 |
Advisories 2
- NCSC-2025-0393 Kwetsbaarheid verholpen in GeoServer NCSC-NL (Netherlands) · Dec 12, 2025
- WID-SEC-2025-2676 GeoServer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2025