# CVE-2025-52465: GeoServer arbitrary file write in Master Password Dump page

Source: https://junglewise.ai/threats/cve-2025-52465-geoserver-arbitrary-file-write-in-master-password-dump-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2025-52465 · Severity: high · CVSS 7.2 · Published 2026-06-18

GeoServer, a platform for sharing geospatial data, contains a security flaw in its administrative web interface. An authorized administrator could exploit this to create files on the server containing the system's master password in plain text. This could lead to full system compromise, unauthorized data access, or the execution of malicious code if the server is configured to run dynamic web scripts.

Technologies: [GeoServer Gs-Web-App](https://junglewise.ai/threats/technologies/gs-main), [org.geoserver.web:gs-web-app (Maven)](https://junglewise.ai/threats/technologies/org-geoserver-web-gs-web-app), [OSGeo GeoServer](https://junglewise.ai/threats/technologies/geoserver). Vendors: [GeoServer](https://junglewise.ai/threats/vendors/geoserver), [Maven](https://junglewise.ai/threats/vendors/maven), [OSGeo](https://junglewise.ai/threats/vendors/osgeo).

## Quick answers

**Is CVE-2025-52465 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-52465 being exploited in the wild.

**How severe is CVE-2025-52465?** High severity, with a CVSS score of 7.2, published 18 June 2026.

**Which products and versions are affected?** GeoServer Gs-Web-App < 2.26.4, >= 2.27.0, < 2.27.3; GeoServer Gs-Web-Sec-Core < 2.26.4, >= 2.27.0, < 2.27.3; org.geoserver.web:gs-web-app (Maven) ECOSYSTEM:introduced=2.27.0,fixed=2.27.3; org.geoserver.web:gs-web-sec-core (Maven) ECOSYSTEM:introduced=2.27.0,fixed=2.27.3; and 1 more.

**Is there a fix for CVE-2025-52465?** Yes. org.geoserver.web:gs-web-app (Maven): upgrade to 2.27.3 or later; org.geoserver.web:gs-web-sec-core (Maven): upgrade to 2.27.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-52465 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-52465?** Check whether you run GeoServer Gs-Web-App, GeoServer Gs-Web-Sec-Core, org.geoserver.web:gs-web-app (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.geoserver.web:gs-web-app (Maven): upgrade to 2.27.3 or later

  ```sh
  # set org.geoserver.web:gs-web-app to 2.27.3 in your pom.xml or build.gradle
  ```

- org.geoserver.web:gs-web-sec-core (Maven): upgrade to 2.27.3 or later

  ```sh
  # set org.geoserver.web:gs-web-sec-core to 2.27.3 in your pom.xml or build.gradle
  ```


## Technical details

An arbitrary file write vulnerability exists in GeoServer's Master Password Dump web page due to insufficient validation of user-supplied file paths. While relative path traversal is blocked by previous fixes, the component accepts absolute paths (CWE-73) to create new files. An authenticated administrator with security system access can specify an absolute path to a non-existent file in an existing directory, causing GeoServer to write the master password in plaintext to that location. If the environment allows dynamic deployment (e.g., a default Tomcat installation), an attacker can embed malicious code in the password field and dump it into a JSP file to achieve Remote Code Execution (RCE). The vulnerability is patched in versions 2.26.4 and 2.27.3.

## Affected products

- GeoServer gs-web-app < 2.26.4, >= 2.27.0, < 2.27.3
- GeoServer gs-web-sec-core < 2.26.4, >= 2.27.0, < 2.27.3

## Identifiers

- CVE-2025-52465
- GHSA-7qmg-grcp-qf25

## Timeline

- 2025-06-02: other: Initial pull request to remove the vulnerable page submitted
- 2025-08-28: patched: Fix merged into main branch
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD

## References

- [https://github.com/geoserver/geoserver/pull/8584](https://github.com/geoserver/geoserver/pull/8584)
- [https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25](https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25)
- [https://osgeo-org.atlassian.net/browse/GEOS-11852](https://osgeo-org.atlassian.net/browse/GEOS-11852)
- [https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild](https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild)

## Related threats

- [GeoServer Server-Side Template Injection in FreeMarker templates](https://junglewise.ai/threats/cve-2024-45747-geoserver-server-side-template-injection-in-freemarker-templates)
- [GeoServer SSRF in XML entity resolution via proxy base URL bypass](https://junglewise.ai/threats/cve-2025-58175-geoserver-ssrf-in-xml-entity-resolution-via-proxy-base-url-bypass)
- [GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format](https://junglewise.ai/threats/cve-2025-21621-geoserver-has-a-reflected-cross-site-scripting-xss-vulnerability)
- [GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature](https://junglewise.ai/threats/cve-2025-58360-osgeo-geoserver-xxe-in-wms-getmap-operation)
- [[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service](https://junglewise.ai/threats/cve-2025-30220-xbow-025-068-xml-external-entity-xxe-processing-vulnerability-in)