# CVE-2025-27511: GeoServer DB2 DataStore Extension RCE via JNDI Injection

Source: https://junglewise.ai/threats/cve-2025-27511-geoserver-db2-datastore-extension-rce-via-jndi-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2025-27511 · Severity: high · CVSS 7.2 · Published 2026-06-18

GeoServer is an open-source platform used to share and edit geospatial data. A vulnerability in its DB2 database connector allows an administrator to execute malicious code on the server by providing a specially crafted database connection string. This could lead to a full system takeover, unauthorized data access, or service disruption.

Vendors: [GeoServer](https://junglewise.ai/threats/vendors/geoserver), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-27511 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-27511 being exploited in the wild.

**How severe is CVE-2025-27511?** High severity, with a CVSS score of 7.2, published 18 June 2026.

**Which products and versions are affected?** GeoServer DB2 DataStore Extension < 2.27.0; org.geoserver.extension:gs-db2 (Maven) < 2.27.0, ECOSYSTEM:introduced=0,fixed=2.27.0.

**Is there a fix for CVE-2025-27511?** Yes. org.geoserver.extension:gs-db2 (Maven): upgrade to 2.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-27511 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-27511?** Check whether you run GeoServer DB2 DataStore Extension or org.geoserver.extension:gs-db2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.geoserver.extension:gs-db2 (Maven): upgrade to 2.27.0 or later

  ```sh
  # set org.geoserver.extension:gs-db2 to 2.27.0 in your pom.xml or build.gradle
  ```


## Technical details

A JNDI injection vulnerability exists in the GeoServer DB2 DataStore Extension due to improper neutralization of DB2 JDBC connection parameters. An authenticated user with administrative privileges can navigate to the Vector Data Sources page and create a new data store using a malicious DB2 JDBC URL. By leveraging the 'clientRerouteServerListJNDIName' property or similar JNDI-related parameters within the connection string, an attacker can trigger the deserialization of untrusted data from a remote server, leading to arbitrary code execution (RCE). This issue is fixed in version 2.27.0.

## Affected products

- GeoServer GeoServer DB2 DataStore Extension < 2.27.0

## Identifiers

- CVE-2025-27511
- GHSA-g628-r368-6vh7

## Timeline

- 2025-04-07: patched: GeoServer 2.27.0 released
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: NVD publication date

## References

- [https://github.com/geoserver/geoserver/releases/tag/2.27.0](https://github.com/geoserver/geoserver/releases/tag/2.27.0)
- [https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7](https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7)
- [https://osgeo-org.atlassian.net/browse/GEOT-7725](https://osgeo-org.atlassian.net/browse/GEOT-7725)