Critical severity · published Feb 21, 2023
CVE-2023-25158
GeoTools is an open source Java library that provides tools for geospatial data
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geotools · Geotools
before 24.7; 25.0 before 25.7; 26.0 before 26.7; 27.0 before 27.4; 28.0 before 28.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25158
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25158
Patch
https://github.com/geotools/geotools/commit/64fb4c47f43ca818c2fe96a94651bff1b3b3ed2b
Mitigation
https://github.com/geotools/geotools/security/advisories/GHSA-99c3-qc2q-p94m
More from Geotools
9.8
CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
9.8
CVE-2026-76904
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
9.1
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data
7.2
CVE-2022-24818
GeoTools is an open source Java library that provides tools for geospatial data