High severity · published Jun 18, 2026
CVE-2025-27511
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
7.2
CVSS
1.1%
EPSS
No
On KEV
Description
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
org.geoserver.extension:gs-db2 · geoserver
< 2.27.0 · source: vendor
GE
Geoserver · Osgeo
before 2.27.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27511
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27511
Product
https://github.com/geoserver/geoserver/releases/tag/2.27.0
Vendor Advisory
https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7
Not Applicable
https://nvd.nist.gov/vuln/detail/cve-2023-27867
Issue Tracking
https://osgeo-org.atlassian.net/browse/GEOT-7725