Executive brief
GeoServer is an open-source platform used to share and edit geospatial data. A vulnerability in its DB2 database connector allows an administrator to execute malicious code on the server by providing a specially crafted database connection string. This could lead to a full system takeover, unauthorized data access, or service disruption.
Technical details
A JNDI injection vulnerability exists in the GeoServer DB2 DataStore Extension due to improper neutralization of DB2 JDBC connection parameters. An authenticated user with administrative privileges can navigate to the Vector Data Sources page and create a new data store using a malicious DB2 JDBC URL. By leveraging the 'clientRerouteServerListJNDIName' property or similar JNDI-related parameters within the connection string, an attacker can trigger the deserialization of untrusted data from a remote server, leading to arbitrary code execution (RCE). This issue is fixed in version 2.27.0.
Affected products
- GeoServer GeoServer DB2 DataStore Extension < 2.27.0
Timeline
- 2025-04-07: patched: GeoServer 2.27.0 released
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: NVD publication date