Critical severity · published Nov 25, 2025
CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
In wildKEV
9.8
CVSS
61.2%
EPSS
Yes
On KEV
Description
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)61.2% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 11, 2025
Federal remediation dueJan 1, 2026
Ransomware campaign useNot known
Affected products
Which versions
GE
geoserver · geoserver
>= 2.26.0, < 2.26.2; < 2.25.6 · source: vendor, NVD, KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-58360: OSGeo GeoServer - OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.
GEGeoServerCVE-2025-58360
Dec 11, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58360
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58360
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
x_refsource_MISC
https://osgeo-org.atlassian.net/browse/GEOS-11682
More from geoserver
9.8
CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
9.8
CVE-2023-35042
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as…
7.5
CVE-2024-24749
GeoServer is an open source server that allows users to share and edit geospatial data
7.2
CVE-2023-51444
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data
7.2
CVE-2023-41877
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data