GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.

GeoServer versions prior to < 2.25.6, 2.26.x < 2.26.2 are affected by an XML External Entity (XXE) vulnerability. An attacker could exploit this vulnerability by sending a specially crafted XML request to the GeoServer instance, which could lead to unauthorized access to sensitive data, server-side request forgery (SSRF), or denial of service (DoS) attacks.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GeoServer is an open source server that allows users to share and edit geospatial data. From version
    2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The
    application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this
    input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within
    the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
    (CVE-2025-58360)

ID	Name	Product	Family	Severity
115075	GeoServer < 2.25.6 / 2.26.x < 2.26.2 XML External Entity	Web App Scanning	Component Vulnerability	critical
436173	SCA: security update for org.geoserver.web:gs-web-app, org.geoserver:gs-wms (GHSA-fjf5-xgmq-5525)	Tenable Cloud Security	SCA Checks	critical
436173	SCA: security update for org.geoserver.web:gs-web-app, org.geoserver:gs-wms (GHSA-fjf5-xgmq-5525)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2025-58360

critical

Tenable Plugins

critical

critical

critical