Recent GeoServer Vulnerability Exploited in Attacks

According to SecurityWeek, a recent OSGeo GeoServer vulnerability, tracked as CVE-2025-58360 with a CVSS of 9.8, is an XML External Entity issue that could allow attackers to access arbitrary files, conduct SSRF, or cause DoS. The flaw centres on insufficient sanitisation of XML input at the /geoserver/wms operation GetMap, enabling external entities to be defined within the XML request.

Patches were released in GeoServer version 2.28.1, announced on 25 November, and the update also patched a medium‑severity XSS vulnerability (CVE-2025-21621); affected packages include docker.osgeo[.]org/geoserver and various Maven components, with recommended versions 2.25.6, 2.26.3, or 2.27.0. On 12 December 2025, CISA added CVE-2025-58360 to its Known Exploited Vulnerabilities list, while advisories from Wiz and the Canadian Cyber Centre indicated that exploitation has existed since late November. Federal agencies under Binding Operational Directive 22-01 have three weeks to identify and patch vulnerable GeoServer instances.