Executive brief
GeoServer is an open-source mapping and geospatial data server used to publish and manage geographic information. An authenticated administrator can upload malicious FreeMarker templates that execute arbitrary operating system commands and read or write any files on the server, bypassing safety restrictions in template processing. This allows complete server compromise with data exfiltration and file manipulation capabilities.
Technical details
A server-side template injection (SSTI) vulnerability exists in GeoServer's FreeMarker template processing. The org.geoserver.template.TemplateUtils.getSafeConfiguration() method attempts to block access to the freemarker.template.utility.Execute class, but attackers can bypass this restriction by chaining specific method calls. The vulnerability affects WMS GetFeatureInfo (HTML and JSON) and WMS GetMap (KML and GeoRSS) output formats in plain GeoServer instances. Exploitation requires authenticated administrator access with the ability to upload or modify FreeMarker templates. An attacker can execute arbitrary OS commands and read/write arbitrary files on the server. The vulnerability is patched in GeoServer 2.27.0 with new configuration properties (GEOSERVER_FREEMARKER_BLOCK_LIST, GEOSERVER_FREEMARKER_ALLOW_LIST, GEOSERVER_FREEMARKER_API_EXPOSED) that restrict template author access by default.
Affected products
- GeoServer Project GeoServer < 2.27.0
- GeoServer Project gs-main < 2.27.0
- GeoServer Project gs-wms < 2.27.0
- GeoServer Project gs-web-app < 2.27.0
Timeline
- 2026-06-11: disclosed: Published in GitHub Advisory Database
- 2026: patched: GeoServer 2.27.0 released with fixes
- 2026-08-19: advisory: GitHub Advisory GHSA-wf6j-gr27-g7ch updated