CVE-2025-58360VulnerabilityAdded to KEV 12/11/2025

CVE-2025-58360: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

Affects OSGeo GeoServerSource CISA KEV

Exploited in the wild · KEV due 1 Jan 2026 · public exploit available (Metasploit) · 60% EPSS : apply the vendor's fix or mitigations to OSGeo GeoServer now.

Data as of 10/24/2026, 22:16:01 UTC

CVSS 3.1 base score

8.2High

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Actively exploited – in CISA KEV since 12/11/2025
KEV deadline: 01/01/2026 US federal agencies must patch by this date; a sensible deadline for everyone else.
EPSS: 60.0% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Public exploits: 1 Metasploit module, a Nuclei detection templatePublic attack or detection tooling exists; see Public exploits below.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

What to do

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits and detection

Metasploit modules

GeoServer WMS GetMap XXE Arbitrary File Readauxiliary · Normal (opens in a new tab)

Nuclei detection templates

GeoServer - XML External Entity Injectionhigh (opens in a new tab)

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

Description

OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.

Weaknesses

CWE-611Improper Restriction of XML External Entity Reference (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Implementation · System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
OWASP Cheat Sheets
Deserialization (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V5.5.2 (opens in a new tab)
Attack patterns
Data Serialization External Entities Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…