# org.geoserver.web:gs-web-app (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/org-geoserver-web-gs-web-app Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/org-geoserver-web-gs-web-app.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in org.geoserver.web:gs-web-app (Maven): 0 in the last 7 days and 1 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2024-45747, was published on 19 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 17 (2 critical, 2 exploited in the wild) ## About org.geoserver.web:gs-web-app (Maven) The web application module for GeoServer, an open-source server for sharing geospatial data. ## Latest org.geoserver.web:gs-web-app (Maven) vulnerabilities - [CVE-2024-45747: GeoServer Server-Side Template Injection in FreeMarker templates](https://junglewise.ai/threats/cve-2024-45747-geoserver-server-side-template-injection-in-freemarker-templates) (high, CVSS 7.2, published 19 Aug 2026) - [CVE-2025-58175: GeoServer SSRF in XML entity resolution via proxy base URL bypass](https://junglewise.ai/threats/cve-2025-58175-geoserver-ssrf-in-xml-entity-resolution-via-proxy-base-url-bypass) (medium, CVSS 6.5, published 18 Jun 2026) - [CVE-2025-52465: GeoServer arbitrary file write in Master Password Dump page](https://junglewise.ai/threats/cve-2025-52465-geoserver-arbitrary-file-write-in-master-password-dump-page) (high, CVSS 7.2, published 18 Jun 2026) - [CVE-2025-21621: GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format](https://junglewise.ai/threats/cve-2025-21621-geoserver-has-a-reflected-cross-site-scripting-xss-vulnerability) (medium, CVSS 6.1, published 25 Nov 2025) - [CVE-2025-58360: GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature](https://junglewise.ai/threats/cve-2025-58360-osgeo-geoserver-xxe-in-wms-getmap-operation) (critical, exploited in the wild, CVSS 8.2, published 25 Nov 2025) - [CVE-2025-30220: XBOW-025-068 XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service](https://junglewise.ai/threats/cve-2025-30220-xbow-025-068-xml-external-entity-xxe-processing-vulnerability-in) (low, CVSS 3.1, published 10 Jun 2025) - [CVE-2025-30145: GeoServer Infinite Loop Vulnerability in Jiffle process](https://junglewise.ai/threats/cve-2025-30145-geoserver-infinite-loop-vulnerability-in-jiffle-process) (low, CVSS 3.1, published 10 Jun 2025) - [CVE-2025-27505: GeoServer Missing Authorization on REST API Index](https://junglewise.ai/threats/cve-2025-27505-geoserver-missing-authorization-on-rest-api-index) (low, CVSS 3.1, published 10 Jun 2025) - [CVE-2024-40625: Coverage REST API Server Side Request Forgery](https://junglewise.ai/threats/cve-2024-40625-coverage-rest-api-server-side-request-forgery) (low, CVSS 3.1, published 10 Jun 2025) - [CVE-2024-38524: GWC Home Page communicate version and revision information](https://junglewise.ai/threats/cve-2024-38524-gwc-home-page-communicate-version-and-revision-information) (low, CVSS 3.1, published 10 Jun 2025) - [CVE-2024-34711: GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)](https://junglewise.ai/threats/cve-2024-34711-geoserver-has-improper-entity-resolution-allowlist-uri-validation) (low, CVSS 3.1, published 10 Jun 2025) - [CVE-2024-35230: Welcome and About GeoServer pages communicate version and revision information](https://junglewise.ai/threats/cve-2024-35230-welcome-and-about-geoserver-pages-communicate-version-and) (low, CVSS 3.1, published 16 Dec 2024) - [CVE-2024-36401: Remote Code Execution (RCE) vulnerability in geoserver](https://junglewise.ai/threats/cve-2024-36401-osgeo-geoserver-geotools-eval-injection-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 1 Jul 2024) - [CVE-2024-24749: Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat](https://junglewise.ai/threats/cve-2024-24749-classpath-resource-disclosure-in-gwc-web-resource-api-on-windows) (low, CVSS 3.1, published 1 Jul 2024) - [CVE-2024-34696: GeoServer's Server Status shows sensitive environmental variables and Java properties](https://junglewise.ai/threats/cve-2024-34696-geoserver-s-server-status-shows-sensitive-environmental-variables) (low, CVSS 3.1, published 1 Jul 2024) - [CVE-2023-41339: Unsecured WMS dynamic styling sld= parameter affords blind unauthenticated SSRF](https://junglewise.ai/threats/cve-2023-41339-unsecured-wms-dynamic-styling-sld-url-parameter-affords-blind) (low, CVSS 3.1, published 24 Oct 2023) - [CVE-2008-7227: PartialBufferOutputStream2 flush issues](https://junglewise.ai/threats/cve-2008-7227-partialbufferoutputstream2-flush-issues) (info, published 17 May 2022) ## Most severe org.geoserver.web:gs-web-app (Maven) vulnerabilities - [CVE-2025-58360: GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature](https://junglewise.ai/threats/cve-2025-58360-osgeo-geoserver-xxe-in-wms-getmap-operation) (critical, exploited in the wild, CVSS 8.2, published 25 Nov 2025) - [CVE-2024-36401: Remote Code Execution (RCE) vulnerability in geoserver](https://junglewise.ai/threats/cve-2024-36401-osgeo-geoserver-geotools-eval-injection-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 1 Jul 2024) - [CVE-2025-52465: GeoServer arbitrary file write in Master Password Dump page](https://junglewise.ai/threats/cve-2025-52465-geoserver-arbitrary-file-write-in-master-password-dump-page) (high, CVSS 7.2, published 18 Jun 2026) - [CVE-2024-45747: GeoServer Server-Side Template Injection in FreeMarker templates](https://junglewise.ai/threats/cve-2024-45747-geoserver-server-side-template-injection-in-freemarker-templates) (high, CVSS 7.2, published 19 Aug 2026) - [CVE-2025-58175: GeoServer SSRF in XML entity resolution via proxy base URL bypass](https://junglewise.ai/threats/cve-2025-58175-geoserver-ssrf-in-xml-entity-resolution-via-proxy-base-url-bypass) (medium, CVSS 6.5, published 18 Jun 2026) - [CVE-2025-21621: GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format](https://junglewise.ai/threats/cve-2025-21621-geoserver-has-a-reflected-cross-site-scripting-xss-vulnerability) (medium, CVSS 6.1, published 25 Nov 2025) - [CVE-2025-30220: XBOW-025-068 XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service](https://junglewise.ai/threats/cve-2025-30220-xbow-025-068-xml-external-entity-xxe-processing-vulnerability-in) (low, CVSS 3.1, published 10 Jun 2025) - [CVE-2025-27505: GeoServer Missing Authorization on REST API Index](https://junglewise.ai/threats/cve-2025-27505-geoserver-missing-authorization-on-rest-api-index) (low, CVSS 3.1, published 10 Jun 2025) - [CVE-2024-24749: Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat](https://junglewise.ai/threats/cve-2024-24749-classpath-resource-disclosure-in-gwc-web-resource-api-on-windows) (low, CVSS 3.1, published 1 Jul 2024) - [CVE-2024-35230: Welcome and About GeoServer pages communicate version and revision information](https://junglewise.ai/threats/cve-2024-35230-welcome-and-about-geoserver-pages-communicate-version-and) (low, CVSS 3.1, published 16 Dec 2024) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core): 259 vulnerabilities - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services): 122 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 60 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [org.elasticsearch:elasticsearch (Maven)](https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch): 41 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "org.geoserver.web:gs-web-app (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-geoserver-web-gs-web-app, 9 November 2026.