CVE-2025-58360

GeoServer, an open source server for sharing and editing geospatial data, is vulnerable to an XML External Entity (XXE) injection flaw (CWE-611) tracked as CVE-2025-58360. The flaw is triggered when an unauthenticated XML request sent to the /geoserver/wms endpoint with operation GetMap is not sufficiently sanitized or restricted, allowing an attacker to define external entities in the request and have the server resolve them, which can lead to disclosure of local files, SSRF to internal services, and potentially further compromise. It carries a CVSS 3.1 score of 9.8 (critical) with high impact on confidentiality, integrity, and availability, and related reporting describes unauthenticated RCE chains affecting government geoportal backends in this software ecosystem. Any organization running GeoServer 2.26.0 up to but not including 2.26.2, or any version before 2.25.6, is affected. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-12-11, and EPSS assigns a 64.9% probability of exploitation within 30 days (99th percentile).

What to do: Upgrade immediately to GeoServer 2.25.6, 2.26.3, or 2.27.0, which contain the fix. If patching is delayed, restrict or firewall access to the /geoserver/wms endpoint (particularly GetMap requests) and limit the server's ability to fetch external resources; federal agencies must follow BOD 22-01 guidance per the KEV listing. Review WMS access logs for suspicious XML entity usage and outbound connections or file-read activity from the GeoServer host as indicators of exploitation.