{"id":"CVE-2025-58360","published":"2025-11-25T21:15:56Z","modified":"2026-10-18T20:10:00Z","title":"OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability","vendor":"OSGeo","product":"GeoServer","tier":"core","eol":null,"description":{"text":"GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an XML External Entity (XXE) vulnerability in the GeoServer open source geospatial data server, specifically in the XML input handling of its /geoserver/wms endpoint for the GetMap operation. An attacker who can send a crafted XML request to that endpoint, without authentication or user interaction, can define external entities that the server processes, provided the affected GeoServer versions are in use (2.26.0 up to 2.26.2, and earlier than 2.25.6).","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:01Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.61169,"percentile":0.9916,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-12-11","dueDate":"2026-01-01","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects an open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525 ; https://osgeo-org.atlassian.net/browse/GEOS-11922 ; https://nvd.nist.gov/vuln/detail/CVE-2025-58360","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-12-05","exploitedFirstSeen":"2025-12-11","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-12-11"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-58360","date":"2025-12-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-16&host_type=src&vulnerability=cve-2025-58360","date":"2025-12-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-17&host_type=src&vulnerability=cve-2025-58360","date":"2025-12-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-18&host_type=src&vulnerability=cve-2025-58360","date":"2025-12-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-19&host_type=src&vulnerability=cve-2025-58360","date":"2025-12-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-20&host_type=src&vulnerability=cve-2025-58360","date":"2025-12-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-21&host_type=src&vulnerability=cve-2025-58360","date":"2025-12-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-22&host_type=src&vulnerability=cve-2025-58360","date":"2025-12-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-23&host_type=src&vulnerability=cve-2025-58360","date":"2025-12-23"}],"evidenceTotal":158,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525","tags":["Vendor Advisory"]},{"url":"https://osgeo-org.atlassian.net/browse/GEOS-11682","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-58360","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated XXE via public WMS endpoint","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allowing an attacker to define external entities within the XML request","start":363,"end":434}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: XXE enables reading local files","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allowing an attacker to define external entities within the XML request","start":363,"end":434}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","vulnerableRanges":[">=2.26.0, <2.26.2","<2.25.6"],"patched":["2.26.2","2.25.6"],"from":["GHSA-fjf5-xgmq-5525"],"provenance":"source"},{"ecosystem":"Maven","package":"org.geoserver:gs-wms","vulnerableRanges":[">=2.26.0, <2.26.2","<2.25.6"],"patched":["2.26.2","2.25.6"],"from":["GHSA-fjf5-xgmq-5525"],"provenance":"source"}],"advisories":[{"id":"GHSA-fjf5-xgmq-5525","url":"https://github.com/advisories/GHSA-fjf5-xgmq-5525","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","vulnerableRanges":[">=2.26.0, <2.26.2"],"patched":["2.26.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-fjf5-xgmq-5525","url":"https://github.com/advisories/GHSA-fjf5-xgmq-5525","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver:gs-wms","vulnerableRanges":[">=2.26.0, <2.26.2"],"patched":["2.26.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-fjf5-xgmq-5525","url":"https://github.com/advisories/GHSA-fjf5-xgmq-5525","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","vulnerableRanges":["<2.25.6"],"patched":["2.25.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-fjf5-xgmq-5525","url":"https://github.com/advisories/GHSA-fjf5-xgmq-5525","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver:gs-wms","vulnerableRanges":["<2.25.6"],"patched":["2.25.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-199606","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199606","exploited":true,"exploitedSince":"2025-12-11","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":1,"earliest":"2025-11-27","earliestUrl":"https://github.com/carlzhang123/Blackash-CVE-2025-58360","repos":[{"name":"quyenheu/CVE-2025-58360","url":"https://github.com/quyenheu/CVE-2025-58360","stars":7,"created":"2025-11-27"},{"name":"quyenheu/Bypass-CVE-2025-58360","url":"https://github.com/quyenheu/Bypass-CVE-2025-58360","stars":1,"created":"2025-12-31"},{"name":"thomas-osgood/cve-2025-58360","url":"https://github.com/thomas-osgood/cve-2025-58360","stars":1,"created":"2026-02-02"},{"name":"carlzhang123/Blackash-CVE-2025-58360","url":"https://github.com/carlzhang123/Blackash-CVE-2025-58360","stars":0,"created":"2025-11-27"},{"name":"rxerium/CVE-2025-58360","url":"https://github.com/rxerium/CVE-2025-58360","stars":0,"created":"2025-12-12"}]},"metasploit":[{"name":"GeoServer WMS GetMap XXE Arbitrary File Read","module":"auxiliary/gather/geoserver_wms_getmap_xxe_file_read","type":"auxiliary","disclosureDate":"2025-11-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb"}],"nuclei":[{"id":"CVE-2025-58360","name":"GeoServer - XML External Entity Injection","severity":"high","path":"http/cves/2025/CVE-2025-58360.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58360.yaml"}],"first":{"date":"2025-11-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2025-11-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58360","provenance":"source"},{"date":"2025-11-25","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-11-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb","provenance":"source"},{"date":"2025-12-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2025-12-11","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-12-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199606","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":16},"priority":{"score":74.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 330 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9916"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2024-23818","published":"2024-03-20","fixed":"2.24.1","kev":false},{"cve":"CVE-2025-21621","published":"2025-11-25","fixed":"2.25.0","kev":false},{"cve":"CVE-2024-36401","published":"2024-07-01","fixed":"2.25.2","kev":true,"link":{"from":"CVE-2024-36401","to":"CVE-2025-58360","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.geoserver:gs-wms","fromFixed":"2.25.2","toFixed":"2.25.6","daysApart":512},{"kind":"version-step","provenance":"source","package":"Maven:org.geoserver.web:gs-web-app","fromFixed":"2.25.2","toFixed":"2.25.6","daysApart":512}]}},{"cve":"CVE-2025-58360","published":"2025-11-25","fixed":"2.26.2","kev":true},{"cve":"CVE-2025-30145","published":"2025-06-10","fixed":"2.26.3","kev":false}],"package":"Maven:org.geoserver:gs-wms"}}