CVE-2025-52465: GeoServer arbitrary file write in Master Password Dump page

CVE-2025-52465 · Severity: high · CVSS 7.2 · Published 2026-06-18

GeoServer, a platform for sharing geospatial data, contains a security flaw in its administrative web interface. An authorized administrator could exploit this to create files on the server containing the system's master password in plain text. This could lead to full system compromise, unauthorized data access, or the execution of malicious code if the server is configured to run dynamic web scripts.

Technologies: GeoServer Gs-Web-App, org.geoserver.web:gs-web-app (Maven), OSGeo GeoServer. Vendors: GeoServer, Maven, OSGeo.

Quick answers

Is CVE-2025-52465 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-52465 being exploited in the wild.
How severe is CVE-2025-52465?
High severity, with a CVSS score of 7.2, published 18 June 2026.
Which products and versions are affected?
GeoServer Gs-Web-App < 2.26.4, >= 2.27.0, < 2.27.3; GeoServer Gs-Web-Sec-Core < 2.26.4, >= 2.27.0, < 2.27.3; org.geoserver.web:gs-web-app (Maven) ECOSYSTEM:introduced=2.27.0,fixed=2.27.3; org.geoserver.web:gs-web-sec-core (Maven) ECOSYSTEM:introduced=2.27.0,fixed=2.27.3; and 1 more.
Is there a fix for CVE-2025-52465?
Yes. org.geoserver.web:gs-web-app (Maven): upgrade to 2.27.3 or later; org.geoserver.web:gs-web-sec-core (Maven): upgrade to 2.27.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-52465 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-52465?
Check whether you run GeoServer Gs-Web-App, GeoServer Gs-Web-Sec-Core, org.geoserver.web:gs-web-app (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.geoserver.web:gs-web-app (Maven): upgrade to 2.27.3 or later
    # set org.geoserver.web:gs-web-app to 2.27.3 in your pom.xml or build.gradle
  • org.geoserver.web:gs-web-sec-core (Maven): upgrade to 2.27.3 or later
    # set org.geoserver.web:gs-web-sec-core to 2.27.3 in your pom.xml or build.gradle

Technical details

An arbitrary file write vulnerability exists in GeoServer's Master Password Dump web page due to insufficient validation of user-supplied file paths. While relative path traversal is blocked by previous fixes, the component accepts absolute paths (CWE-73) to create new files. An authenticated administrator with security system access can specify an absolute path to a non-existent file in an existing directory, causing GeoServer to write the master password in plaintext to that location. If the environment allows dynamic deployment (e.g., a default Tomcat installation), an attacker can embed malicious code in the password field and dump it into a JSP file to achieve Remote Code Execution (RCE). The vulnerability is patched in versions 2.26.4 and 2.27.3.

Affected products

  • GeoServer gs-web-app < 2.26.4, >= 2.27.0, < 2.27.3
  • GeoServer gs-web-sec-core < 2.26.4, >= 2.27.0, < 2.27.3

Identifiers

  • CVE-2025-52465
  • GHSA-7qmg-grcp-qf25

Timeline

  • 2025-06-02: other: Initial pull request to remove the vulnerable page submitted
  • 2025-08-28: patched: Fix merged into main branch
  • 2026-06-11: advisory: GitHub Security Advisory published
  • 2026-06-18: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.