CVE-2025-30220

GeoTools' Schema classes (gt-xsd-core) use the Eclipse XSD library to represent schema data structures but do not apply the EntityResolver configured on the ParserHandler, leaving XML parsing vulnerable to XML External Entity (XXE) injection when a submitted document references an external XML schema. Any deployment that exposes XML processing through gt-xsd-core is impacted, including GeoServer's XML/WFS handling and users of the gt-wfs-ng DataStore, where the ENTITY_RESOLVER connection parameter was not applied as intended; a remote, unauthenticated attacker can trigger it by sending crafted XML referencing external entities. Successful exploitation can disclose local files (high confidentiality impact per the 9.1 CVSS), enable SSRF (CWE-918) toward internal networks, and exhaust resources (high availability impact). Affected users are GeoServer deployments prior to 2.25.7/2.26.3/2.27.1, GeoNetwork deployments prior to 4.4.8/4.2.13, and any application embedding affected GeoTools versions. There is no CISA KEV listing or confirmed in-the-wild exploitation in the available data, but a public advisory exists and EPSS assigns a 46.1% probability of exploitation within 30 days (99th percentile), signaling high near-term risk.

What to do: Upgrade GeoServer to 2.27.1, 2.26.3, or 2.25.7; GeoNetwork to 4.4.8 or 4.2.13; and GeoTools to 33.1, 32.3, 31.7, or 28.6.1 as applicable. Until patched, restrict or disable XML endpoints that accept documents referencing external XML schemas (e.g., WFS/XML inputs) and apply WAF or egress controls to block external entity resolution to internal or remote hosts. Audit any gt-wfs-ng DataStore connections to verify the ENTITY_RESOLVER connection parameter is set as intended.