Skip to content

Vendor

geoserver vulnerabilities

33 published CVES affecting geoserver, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
33
Critical
5
High
13
Medium
15
Low
0
Unscored
0
CISA KEV
2
Atom feed of geoserver alerts

Products

Latest geoserver CVEs

Newest publication first · page 1 of 2

  5. CVE-2025-58360 GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

    Published
    CriticalCVSS 9.8 EPSS 61.2% CISA KEV added 2025-12-11 Exploited in the wild Framework module

    GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms...

  7. CVE-2025-30145 GeoServer has an Infinite Loop Vulnerability in Jiffle process

    Published
    HighCVSS 7.5 EPSS 0.53%

    GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of serv...

  8. CVE-2025-27505 GeoServer Missing Authorization on REST API Index

    Published
    MediumCVSS 5.3 EPSS 1.2%

    GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html). The REST...

  9. CVE-2024-40625 GeoServer Coverage REST API Allows Server Side Request Forgery

    Published
    MediumCVSS 4.9 EPSS 0.39%

    GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restri...

  10. CVE-2024-38524 GWC Home Page communicate version and revision information

    Published
    HighCVSS 7.5 EPSS 0.46%

    GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system prop...

  12. CVE-2024-29198 GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

    Published
    HighCVSS 8.2 EPSS 2.3%

    GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2,...

  14. CVE-2024-36401 Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

    Published
    CriticalCVSS 9.8 EPSS 99.8% CISA KEV added 2024-07-15 Exploited in the wild Framework module PoC

    GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a defau...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.