CVE-2025-58360
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
Description
CVE-2025-58360 is a high-severity XML External Entity (XXE) injection vulnerability in GeoServer, the open-source geospatial data server maintained by OSGeo. With a CVSS v3.1 base score of 8.2, the vulnerability exists in the WMS (Web Map Service) GetMap operation endpoint and allows an unauthenticated remote attacker to define external entities in XML input that the server processes without proper sanitization. This can lead to server-side request forgery, sensitive file disclosure, and denial of service. Versions from 2.26.0 to before 2.26.2 and versions before 2.25.6 are affected. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 1, 2026, and carries an exceptionally high EPSS score of 0.85689 (99.4th percentile), indicating extremely widespread active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| geoserver | geoserver | < 2.25.6; >= 2.26.0, < 2.26.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525(Vendor Advisory)
- https://osgeo-org.atlassian.net/browse/GEOS-11682(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-58360(US Government Resource)
Weakness Type
CWE-611: Improper Restriction of XML External Entity Reference
CVE-2025-58360 is classified under CWE-611, which describes a condition where an application processes XML input that contains references to external entities without properly restricting or disabling this functionality. In the case of GeoServer, the WMS GetMap operation accepts XML input that includes document type declarations (DTDs) with external entity definitions. When the XML parser processes these entities, it resolves them by fetching external resources, reading local files, or making network requests as directed by the attacker. XXE vulnerabilities are particularly dangerous when they affect server-side applications that process untrusted XML from network clients, as they can be used for data exfiltration, internal network reconnaissance, and denial of service through entity expansion attacks. Learn more about CWE-611
Impact Analysis
Confidentiality is rated as high impact (C:H), reflecting the ability of an attacker to read arbitrary files from the server filesystem through the XXE vulnerability. This can expose sensitive configuration files, database credentials, private keys, and other secrets stored on the GeoServer host. The attacker can also perform server-side request forgery to access internal network resources and cloud metadata endpoints.
Availability is rated as low impact (A:L), acknowledging that XXE attacks can cause denial of service through recursive entity expansion ("billion laughs" attack) or by directing the server to fetch very large external resources, consuming memory and CPU.
Business Impact is severe for organizations deploying GeoServer for geospatial data services. GeoServer instances are frequently exposed to the public internet to serve map data for web applications, and they often have access to sensitive geographic information systems (GIS) data, infrastructure mapping, and internal network resources. Compromise of a GeoServer instance can expose proprietary geospatial data, enable reconnaissance of internal network topology, and provide a foothold for further attacks.
Exploitation Probability is extremely high. The EPSS score of 0.85689 (99.4th percentile) places this vulnerability among the most heavily exploited CVEs currently tracked, indicating that mass exploitation is actively occurring. The combination of a well-understood attack technique (XXE), publicly accessible endpoints, and no authentication requirement makes this vulnerability trivially exploitable at scale.
Exploit Maturity
CVE-2025-58360 has confirmed, widespread active exploitation. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 1, 2026. The EPSS score of 0.85689 (99.4th percentile) is among the highest observed, indicating that this vulnerability is being exploited more actively than virtually all other known CVEs. This places it in the top 1% of exploited vulnerabilities globally.
The vulnerability details are publicly documented in GeoServer's security advisory GHSA-fjf5-xgmq-5525 and tracked in GEOS-11682. XXE exploitation techniques are well-understood, extensively documented, and straightforward to implement. The attack requires no authentication, no user interaction, and targets a standard WMS endpoint that is typically exposed to the internet by design. Automated scanning tools and exploitation frameworks readily support XXE attacks, making mass exploitation trivial once the vulnerable endpoint is identified. The ransomware association is listed as "Unknown" by CISA, but the ability to read files and perform SSRF from compromised GeoServer instances provides valuable access that can be leveraged in multi-stage attack campaigns.
Remediation
-
Upgrade GeoServer to Version 2.25.6 or 2.26.2 or Later — This is the most critical remediation step. The patched versions disable external entity processing in the XML parser used by the WMS GetMap endpoint. For users on the 2.26.x branch, upgrade to 2.26.2 or later. For users on the 2.25.x branch, upgrade to 2.25.6 or later. Refer to the GeoServer security advisory for detailed upgrade instructions.
-
Apply XML Parser Hardening — As an interim mitigation, configure the Java XML parser to disable external entity processing and DTD processing. This can be done by setting system properties such as
javax.xml.parsers.DocumentBuilderFactoryto use a secure factory configuration and by enabling theFEATURE_SECURE_PROCESSINGflag. -
Restrict Access to WMS Endpoints — Use a reverse proxy or web application firewall (WAF) to restrict access to GeoServer's WMS endpoints. Implement request filtering to block XML payloads containing DTD declarations or external entity references. Only allow access from trusted networks or authenticated clients where possible.
-
Audit Server for Compromise Indicators — Given the extremely high exploitation rate, review GeoServer access logs for suspicious requests to the WMS GetMap endpoint, particularly those containing XML payloads with DOCTYPE declarations, ENTITY definitions, or references to local files (e.g., /etc/passwd) and internal network addresses. Check for unexpected outbound connections from the GeoServer host.
-
Implement Network Segmentation — Ensure GeoServer instances cannot access sensitive internal resources, cloud metadata endpoints, or databases beyond what is strictly required for operation. This limits the impact of SSRF attacks conducted through the XXE vulnerability even if the GeoServer instance is compromised.
Technical Details
CVE-2025-58360 is an XML External Entity (XXE) injection vulnerability in GeoServer's WMS (Web Map Service) GetMap operation. The vulnerability exists because the XML parser used to process incoming GetMap requests does not disable external entity resolution, allowing an attacker to inject malicious XML payloads that reference external resources.
CVSS Vector Breakdown: The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L vector reflects the nature of the XXE attack. Attack Vector (AV:N) means the vulnerability is exploitable remotely over the network. Attack Complexity (AC:L) indicates no special conditions are required. Privileges Required (PR:N) confirms no authentication is needed. User Interaction (UI:N) means no legitimate user action is required. Scope (S:U) is unchanged. Confidentiality (C:H) is high because the attacker can read arbitrary files. Integrity (I:N) is not directly impacted. Availability (A:L) can be degraded through entity expansion attacks.
Attack Mechanism: The attacker sends a specially crafted XML request to the GeoServer WMS GetMap endpoint at /geoserver/wms. The XML payload includes a Document Type Definition (DTD) that declares an external entity pointing to a local file or remote URL. When the XML parser processes the request, it resolves the external entity by reading the referenced resource and incorporating its content into the parsed XML document. The attacker can then extract the file content through error messages, out-of-band channels, or by embedding the entity value in a response parameter. For server-side request forgery, the external entity references an internal URL, causing the GeoServer to make requests to internal services on behalf of the attacker. The vulnerability was introduced in the code path handling GetMap requests and affects GeoServer versions from 2.26.0 to 2.26.2 and all versions before 2.25.6.
Frequently Asked Questions
How severe is the active exploitation of CVE-2025-58360?
The EPSS score of 0.85689 (99.4th percentile) indicates that this is one of the most actively exploited vulnerabilities in the current threat landscape. It is being exploited more frequently than 99.4% of all known CVEs. Organizations running vulnerable GeoServer instances should assume they have been or will be targeted.
Which GeoServer versions are affected?
GeoServer versions from 2.26.0 to before 2.26.2 and all versions before 2.25.6 are affected. Users should upgrade to version 2.25.6 or 2.26.2 or later to remediate the vulnerability.
What can an attacker achieve through this XXE vulnerability?
An attacker can read arbitrary files from the server filesystem (such as configuration files and credentials), perform server-side request forgery to access internal network resources and cloud metadata endpoints, and cause denial of service through entity expansion attacks. No authentication is required to exploit this vulnerability.
Is GeoServer typically exposed to the internet?
Yes. GeoServer is designed to serve geospatial data to web mapping applications and is frequently deployed with public-facing WMS endpoints. This makes the attack surface readily discoverable and accessible, contributing to the extremely high exploitation rate observed for this vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.