CVE-2024-45747: GeoServer Server-Side Template Injection in FreeMarker templates

CVE-2024-45747 · Severity: high · CVSS 7.2 · Published 2026-08-19

GeoServer is an open-source mapping and geospatial data server used to publish and manage geographic information. An authenticated administrator can upload malicious FreeMarker templates that execute arbitrary operating system commands and read or write any files on the server, bypassing safety restrictions in template processing. This allows complete server compromise with data exfiltration and file manipulation capabilities.

Technologies: org.geoserver:gs-main (Maven), org.geoserver:gs-wms (Maven), org.geoserver.web:gs-web-app (Maven). Vendors: Maven.

Quick answers

Is CVE-2024-45747 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-45747 being exploited in the wild.
How severe is CVE-2024-45747?
High severity, with a CVSS score of 7.2, published 19 August 2026.
Which products and versions are affected?
org.geoserver:gs-main (Maven) < 2.27.0, ECOSYSTEM:introduced=0,fixed=2.27.0; org.geoserver:gs-wms (Maven) < 2.27.0, ECOSYSTEM:introduced=0,fixed=2.27.0; org.geoserver.web:gs-web-app (Maven) < 2.27.0, ECOSYSTEM:introduced=0,fixed=2.27.0.
Is there a fix for CVE-2024-45747?
Yes. org.geoserver:gs-main (Maven): upgrade to 2.27.0 or later; org.geoserver:gs-wms (Maven): upgrade to 2.27.0 or later; org.geoserver.web:gs-web-app (Maven): upgrade to 2.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45747 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2024-45747?
Check whether you run org.geoserver:gs-main (Maven), org.geoserver:gs-wms (Maven) or org.geoserver.web:gs-web-app (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.geoserver:gs-main (Maven): upgrade to 2.27.0 or later
    # set org.geoserver:gs-main to 2.27.0 in your pom.xml or build.gradle
  • org.geoserver:gs-wms (Maven): upgrade to 2.27.0 or later
    # set org.geoserver:gs-wms to 2.27.0 in your pom.xml or build.gradle
  • org.geoserver.web:gs-web-app (Maven): upgrade to 2.27.0 or later
    # set org.geoserver.web:gs-web-app to 2.27.0 in your pom.xml or build.gradle

Technical details

A server-side template injection (SSTI) vulnerability exists in GeoServer's FreeMarker template processing. The org.geoserver.template.TemplateUtils.getSafeConfiguration() method attempts to block access to the freemarker.template.utility.Execute class, but attackers can bypass this restriction by chaining specific method calls. The vulnerability affects WMS GetFeatureInfo (HTML and JSON) and WMS GetMap (KML and GeoRSS) output formats in plain GeoServer instances. Exploitation requires authenticated administrator access with the ability to upload or modify FreeMarker templates. An attacker can execute arbitrary OS commands and read/write arbitrary files on the server. The vulnerability is patched in GeoServer 2.27.0 with new configuration properties (GEOSERVER_FREEMARKER_BLOCK_LIST, GEOSERVER_FREEMARKER_ALLOW_LIST, GEOSERVER_FREEMARKER_API_EXPOSED) that restrict template author access by default.

Affected products

  • GeoServer Project GeoServer < 2.27.0
  • GeoServer Project gs-main < 2.27.0
  • GeoServer Project gs-wms < 2.27.0
  • GeoServer Project gs-web-app < 2.27.0

Identifiers

  • CVE-2024-45747
  • GHSA-wf6j-gr27-g7ch

Timeline

  • 2026-06-11: disclosed: Published in GitHub Advisory Database
  • 2026: patched: GeoServer 2.27.0 released with fixes
  • 2026-08-19: advisory: GitHub Advisory GHSA-wf6j-gr27-g7ch updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.