GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE
A CVSS 9.8 SQL injection zero-day in GeoServer's PostGIS datastore enables RCE and drew active exploitation; fixes shipped in versions 3.0.1, 2.28.5, 2.27.6.
A SQL injection flaw in GeoServer's jsonArrayContains function within the GeoTools PostGIS datastore (GHSA-mqjf-5f49-2fjh, CVSS 9.8) was disclosed August 12, 2026, and saw hundreds of exploitation attempts within hours per watchTowr. An attacker-controlled value is interpolated into a PostgreSQL jsonb_path_exists() expression without escaping; with superuser or pg_execute_server_program privileges it escalates to OS command execution via WFS 1.0. GeoServer released versions 3.0.1, 2.28.5, and 2.27.6, and the flaw is a regression of CVE-2023-25158. GeoServer has a history of mass exploitation, including CVE-2024-36401 used for botnets and proxies.
- Unpatched zero-day SQL injection disclosed August 12 and exploited within hours
- Escalates to RCE when GeoServer connects to PostgreSQL with elevated privileges
- Fixes released in GeoServer 3.0.1, 2.28.5, and 2.27.6 plus GeoTools updates
- Regression of 2023's CVE-2023-25158; predecessors were mass-exploited in 2024
- Products
- GeoServer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-25157 | GeoServer: GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web… | 9.8 | 85% | ||
| CVE-2023-25158 | GeoTools: GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL… | 9.8 | 1% | ||
| CVE-2024-36401 | Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection | 9.8 | 100% | KEVPoC ×3 | KEV |
From the original article
3 min read at thehackernews.com
A newly disclosed zero-day flaw in GeoServer is seeing active exploitation efforts, per watchTowr. The vulnerability, which has yet to be assigned a CVE identifier, is an SQL injection vulnerability in the open-source platform that can lead to remote code execution (RCE). The security defect remains unpatched.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.