CVE-2025-27511

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

7.2 HighFix available

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.07%Up 0.7 points since Jun 12, 2026

What each source reports

CVE List Score used 7.2

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

Record: CVE-2025-27511
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502, CWE-74
Updated: 2026-11-02

EUVDEUVD-2025-210276 7.2

Record: EUVD-2025-210276
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-g628-r368-6vh7 7.2

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

Summary

Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution (RCE).

Impact

If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code.

Details

Authenticated users can access Vector Data Sources page to creating a new data store through db2 jdbc connection, performing JNDI attack due to unrestricted connection parameters, and then achieve RCE with deserialization of untrusted data.

Remediation

This issue has been fixed in this release: https://github.com/geoserver/geoserver/releases/tag/2.27.0.

References

Record: GHSA-g628-r368-6vh7
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-74, CWE-502
Updated: 2026-11-02

NVD 7.2

Record: CVE-2025-27511
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-74, CWE-502
Updated: 2026-11-02

OSV 7.2

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

Record: CVE-2025-27511
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502, CWE-74
Updated: 2026-11-02

OSVGHSA-g628-r368-6vh7 7.2

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

Summary

Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution (RCE).

Impact

If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code.

Details

Remediation

This issue has been fixed in this release: https://github.com/geoserver/geoserver/releases/tag/2.27.0.

References

Record: GHSA-g628-r368-6vh7
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502, CWE-74
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.geoserver.extension:gs-db2` Maven	before 2.27.0	2.27.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-27511 is a high vulnerability (CVSS 7.2) in Osgeo Geoserver, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 65th percentile. Fixed in org.geoserver.extension:gs-db2 2.27.0.