Report · Reddit NetSecAbout CVE-2025-58360Published 28 Nov 2025

CVE-2025-58360: GeoServer XXE Vulnerability Analysis

Affects OSGeo GeoServerSource Reddit NetSec

Authoritative record:CVE-2025-58360· High 8.2

Exploited in the wild · KEV due 1 Jan 2026 · public exploit available (Metasploit) · 61% EPSS : upgrade to 2.26.2 or 2.25.6 now.

Data as of 27 Oct 2026, 05:11 UTC

CVSS 3.1 base score

8.2High

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 1 Jan 2026 US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
EPSS: 61.1% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 2.26.2, 2.25.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 25 Nov 2025
Detectable: evidence found.
nuclei template: GeoServer - XML External Entity Injection
Weaponised: evidence found.
1 Metasploit module
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 16 days after disclosure
Observed by OffSeq MirageSeen by Mirage: evidence found.
1 exposed host found; no attack traffic recorded

CVE published
on cve.org
25 Nov 202520:17 UTC, t = 0
Added to CISA KEV (opens in a new tab)
exploitation confirmed
11 Dec 2025, 16 days after disclosure
In Threat Radar
record ingested
12 Dec 202500:00 UTC, 17 days after disclosure
KEV remediation due
US federal deadline
1 Jan 2026, 37 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), OffSeq Mirage (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade OSGeo GeoServer to 2.26.2 or 2.25.6.

Affected software

Product	Affected	Fixed in
geoservergeoserver	Affected >=2.26.0 <2.26.2	Fixed in 2.26.2
geoservergeoserver	Affected <2.25.6	Fixed in 2.25.6

Description

CVE-2025-58360 is a high-severity XML External Entity (XXE) vulnerability affecting GeoServer, an open-source server for sharing geospatial data. This vulnerability allows attackers to exploit XML parsers to read arbitrary files, cause denial of service, or potentially execute remote code. Although no known exploits are currently active in the wild, the vulnerability poses significant risks to organizations relying on GeoServer for geospatial data services. European organizations using GeoServer in critical infrastructure, government, or environmental monitoring could face data breaches or service disruptions. Mitigation requires disabling external entity processing in XML parsers, applying patches once available, and restricting network access to GeoServer instances. Countries with high adoption of geospatial technologies and critical infrastructure reliance on GeoServer, such as Germany, France, the UK, and the Netherlands, are most at risk. Given the ease of exploitation without authentication and the potential impact on confidentiality and availability, this vulnerability is assessed as high severity. Defenders should prioritize vulnerability scanning, configuration audits, and network segmentation to reduce exposure.

Impact

The impact of CVE-2025-58360 on European organizations can be substantial due to GeoServer’s role in managing critical geospatial data used in infrastructure planning, environmental monitoring, and public services. Confidentiality breaches could expose sensitive location data or internal configuration files, leading to privacy violations or intelligence gathering by adversaries. Integrity could be compromised if attackers manipulate geospatial data or configurations, affecting decision-making processes. Availability impacts could disrupt essential services relying on GeoServer, such as emergency response systems or transportation management. The ease of exploitation without authentication and the potential for remote attacks increase the risk of widespread exploitation, especially for organizations with publicly accessible GeoServer instances. European entities in sectors like government, utilities, and environmental agencies are particularly vulnerable, as they often rely on GeoServer for critical operations. The absence of known exploits currently provides a window for proactive mitigation, but the high severity rating underscores the urgency of addressing this vulnerability to prevent future attacks.

Mitigation

To mitigate CVE-2025-58360, European organizations should immediately audit their GeoServer deployments to identify exposure to XML external entity processing. Administrators should disable external entity resolution in XML parsers used by GeoServer by configuring parser features such as 'http://apache.org/xml/features/disallow-doctype-decl' and 'http://xml.org/sax/features/external-general-entities' to false. Network segmentation should be enforced to restrict access to GeoServer instances, limiting exposure to trusted internal networks only. Organizations should monitor for unusual XML payloads or spikes in traffic indicative of exploitation attempts. Applying security patches promptly once released by GeoServer maintainers is critical. Additionally, implementing Web Application Firewalls (WAFs) with rules to detect and block XXE payloads can provide an additional layer of defense. Regular vulnerability scanning and penetration testing focused on XML processing components will help identify residual risks. Finally, educating developers and administrators about secure XML handling practices will reduce the likelihood of similar vulnerabilities in the future.

Summary

CVE-2025-58360 is an XML External Entity (XXE) vulnerability identified in GeoServer, a widely used open-source server for sharing and editing geospatial data. XXE vulnerabilities occur when XML parsers process external entity references, allowing attackers to read local files, perform server-side request forgery (SSRF), or cause denial of service (DoS) by exhausting resources. GeoServer’s XML processing components are vulnerable to such attacks, enabling malicious actors to craft specially crafted XML payloads that exploit the parser’s handling of external entities. This can lead to unauthorized disclosure of sensitive files, disruption of service, or potentially remote code execution depending on the server environment and configuration. The vulnerability was publicly disclosed on November 28, 2025, with limited discussion and no known exploits in the wild at the time of reporting. No specific affected versions or patches have been detailed yet, but the high severity rating indicates significant risk. GeoServer is commonly deployed in government agencies, environmental monitoring, urban planning, and utilities sectors, where geospatial data integrity and availability are critical. The vulnerability’s exploitation requires sending malicious XML data to GeoServer endpoints, which may not require authentication depending on the deployment. This increases the attack surface, especially for publicly accessible GeoServer instances. The lack of a CVSS score necessitates a severity assessment based on impact and exploitability factors.

CWE-611Improper Restriction of XML External Entity Reference (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Implementation · System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
OWASP Cheat Sheets
Deserialization (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V5.5.2 (opens in a new tab)
Attack patterns
Data Serialization External Entities Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 28 Nov 2025, 14:54 UTC

Public exploits and detection1 Metasploit module, a Nuclei detection template

WeaknessesCWE-611

Technical details

References

Community reviews

Related threats