Executive brief
GeoServer, an open-source platform for sharing and editing geospatial data, contains a critical security flaw in its map-rendering component. An attacker can exploit this to read sensitive files from the server or disrupt operations. This vulnerability is currently being exploited in the wild, posing a significant risk to organizations using unpatched versions.
Technical details
An XML External Entity (XXE) vulnerability exists in OSGeo GeoServer within the /geoserver/wms endpoint during GetMap operations. The application fails to sufficiently sanitize or restrict XML input, allowing an unauthenticated remote attacker to define external entities within a crafted XML request. This can lead to the disclosure of sensitive local files, server-side request forgery (SSRF), or denial-of-service. The vulnerability affects versions 2.26.x prior to 2.26.2 and versions prior to 2.25.6. Patches are available in versions 2.25.6, 2.26.3, and 2.27.0. This flaw is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.
Affected products
- OSGeo GeoServer 2.26.0 to 2.26.1, versions prior to 2.25.6
Timeline
- 2025-11-25: disclosed
- 2025-12-11: kev added: Added to CISA KEV catalog due to active exploitation.
- 2025-12-11: patched: Patches released in versions 2.25.6, 2.26.3, and 2.27.0.