CVE-2024-36401
OSGeo GeoServer GeoTools Eval Injection Vulnerability
Published Jul 1, 2024 · corrected/updated Jun 17, 2026 · geoserver geoserver · evidence confidence very high
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the file from the GeoServer where is the GeoTools version (e.g., if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2024-36401 is a critical public vulnerability record for geoserver geoserver. CISA lists it as known exploited. Published remediation guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether geoserver geoserver is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: geoserver/geoserver; geotools/geotools; geotools/geotools (30.0); OSGeo GeoServer. Published remediation guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 9.8, EPSS 99.8%. CISA lists it as known exploited. Weakness classes: CWE-94, CWE-95. Sources contributing to this record: cisa_kev, cve_org, epss, metasploit. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Confirmed in CISA KEV since Jul 15, 2024. Listed in the CISA Known Exploited Vulnerabilities catalog.
Patch and remediation
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA due date Aug 5, 2024.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jul 1, 2024 · Catalog
Detected
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that
Jul 15, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Aug 5, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that
Affected
- cpe geoserver/geoserverversion unspecified
- cpe geotools/geotoolsversion unspecified
- cpe geotools/geotools30.0
- vendor OSGeo GeoServerversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2024-36401
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.
cisa.gov - CVE.orgVulnerability recordCVE-2024-36401
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2024-36401
30-day exploitation probability 99.8%
first.org - Metasploit ModulesPublic exploit moduleexploit_multi/http/geoserver_unauth_rce_cve_2024_36401
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2024-36401
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a defau
nvd.nist.gov