High-Severity GeoServer Flaw (CVE-2025-58360) Allows Unauthenticated XXE for File Theft and SSRF

GeoServer has announced a critical security vulnerability (CVE-2025-58360) with a CVSS score of 8.2, allowing unauthenticated attackers to exfiltrate files or crash servers. This XML External Entity (XXE) flaw affects the Web Map Service (WMS) due to insufficient input sanitization. Attackers can exploit this vulnerability to read arbitrary files, conduct Server-Side Request Forgery (SSRF), and execute Denial of Service (DoS) attacks. System administrators are urged to upgrade to GeoServer versions 2.25.6, 2.26.3, or 2.27.0 to mitigate the risk.