GeoServer GetMap Endpoint XML External Entity (XXE) Injection Vulnerability Advisory (CVE-2025-58360)
Executive & SecOps Summary
SECOPS ASSESSMENTGeoServer versions from 2.25.0 to before 2.25.6, and from 2.26.0 to before 2.26.3
Unauthenticated remote attackers can exploit the GetMap XML request to read arbitrary local files, perform Server-Side Request Forgery (SSRF), or trigger Denial of Service (DoS)
Immediately upgrade GeoServer to patched versions 2.25.6, 2.26.3, or 2.27.0 and above
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade GeoServer to the patched versions (2.25.6, 2.26.3, or 2.27.0+). For Docker-based deployments, update your image tag and redeploy:
# Example Docker Compose upgrade
# Update the geoserver image tag in docker-compose.yml to a patched version
sed -i 's/geoserver:2.26.0/geoserver:2.26.3/g' docker-compose.yml
docker-compose pull
docker-compose up -d2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, restrict XML POST requests to the WMS endpoint using a reverse proxy like Nginx, or restrict access to trusted IP ranges.
# Nginx configuration to block POST requests to the WMS endpoint
server {
listen 80;
server_name geoserver.local;
location /geoserver/wms {
if ($request_method = POST) {
return 403 'POST requests to WMS are restricted.';
}
proxy_pass http://localhost:8080/geoserver/wms;
}
}3. Log Audit & IoC Verification Commands
Inspect GeoServer access logs for suspicious POST requests containing XML payloads directed at the WMS endpoint.
# Search logs for potential XXE payloads containing ENTITY, SYSTEM, or PUBLIC definitions
grep -i 'POST' /var/log/geoserver/*.log | grep -i 'wms' | grep -E 'ENTITY|SYSTEM|PUBLIC'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-58360) is an XML External Entity (XXE) injection vulnerability (CWE-611) identified in GeoServer's Web Map Service (WMS) GetMap operation endpoint (/geoserver/wms). The root cause lies in the application's failure to sufficiently sanitize or restrict XML input accepted through the GetMap operation. This allows an attacker to define and resolve external entities within the XML request.
2. Exploitation Mechanics & Attack Scenario
An attacker can send a specially crafted XML POST request to the unauthenticated GetMap endpoint. By defining an external entity pointing to local system files (e.g., SYSTEM 'file:///etc/passwd') or internal network resources within the XML payload, the vulnerable XML parser resolves the entity and includes the sensitive content in the response. This can also be leveraged to conduct SSRF attacks against internal infrastructure.
3. Infrastructure & Business Impact
With a CVSS score of 8.2 and its inclusion in the CISA KEV catalog, this vulnerability poses a severe threat. Successful exploitation allows unauthorized access to sensitive configuration files, credentials, and internal network services. This can lead to full system compromise, data exfiltration, and lateral movement within the enterprise network.
Official Vendor Advisories & References
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
Frequently Asked SecOps Questions (CVE-2025-58360)
FAQQ1. How critical is CVE-2025-58360 and is it actively exploited in the wild?
CVE-2025-58360 is rated CVSS 8.2 (HIGH) with a 30-day EPSS exploitation probability of 61.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-58360?
Primary impacted vendors include geoserver across geoserver. Scope summary: GeoServer versions 2.25.x (before 2.25.6) and 2.26.x (before 2.26.3)
Q3. What temporary mitigations or workarounds exist for CVE-2025-58360 before patching?
[Mitigation] Immediately upgrade GeoServer to patched versions 2.25.6, 2.26.3, or 2.27.0 and above Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-58360
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (geoserver)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.