Research · Nov 25, 2025 · ZeroDay Catalog
Critical XXE Vulnerability Discovered in OSGeo GeoServer
A significant XML External Entity vulnerability has been identified in OSGeo GeoServer, affecting multiple versions and requiring immediate attention from users.
What changed
An XML External Entity (XXE) vulnerability has been discovered in OSGeo GeoServer, specifically affecting versions from 2.26.0 to before 2.26.2 and before 2.25.6. This vulnerability arises from insufficient sanitization of XML input, allowing attackers to exploit the /geoserver/wms operation GetMap endpoint.
The vulnerability permits the definition of external entities within XML requests, posing a risk of sensitive data exposure and potential server compromise.
Who is affected
Organizations utilizing OSGeo GeoServer versions 2.26.0 to 2.26.2 and 2.25.6 or earlier are at risk. This includes a wide range of users in sectors such as government, environmental research, and urban planning.
The vulnerability could impact any entity that relies on GeoServer for sharing and editing geospatial data, making it critical for these users to take immediate action.
- OSGeo GeoServer users running affected versions
- Government agencies utilizing geospatial data services
- Environmental research organizations relying on GeoServer
- Urban planning departments using GeoServer for data management
What to do
Users of the affected GeoServer versions should upgrade to the patched versions: GeoServer 2.25.6, 2.26.3, or 2.27.0 to mitigate the risk associated with this vulnerability.
It is also recommended to review XML input handling practices to ensure that similar vulnerabilities do not arise in the future.
- Upgrade to GeoServer 2.25.6, 2.26.3, or 2.27.0 immediately
- Review and enhance XML input sanitization processes
- Monitor for any unusual activities related to GeoServer operations