Geoserver vulnerabilities

Products

• Geoserver 29
• Geowebcache 2
• Org.geoserver.web:gs-web-app 2

Newest

• osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver:gs-main +2 more GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution CVE-2025-58175 Fix available 6.5 MediumJune 12, 2026
• osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core +2 more GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page CVE-2025-52465 Fix available 7.2 HighJune 12, 2026
• osgeo geoserver, geoserver org.geoserver.extension:gs-db2 +1 more GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection CVE-2025-27511 Fix available 7.2 HighJune 11, 2026
• geoserver GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature CVE-2025-58360 In KEVPublic exploitFix available EPSS 61.2% 8.2 HighNovember 25, 2025
• geoserver GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format CVE-2025-21621 Fix available 6.1 MediumNovember 25, 2025
• geoserver, geotools, osgeo geonetwork +2 more GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling CVE-2025-30220 Fix available EPSS 43.6% 9.9 CriticalJune 10, 2025
• geoserver GeoServer has an Infinite Loop Vulnerability in Jiffle process CVE-2025-30145 Fix available 7.5 HighJune 10, 2025
• geoserver GeoServer Missing Authorization on REST API Index CVE-2025-27505 Fix available 5.3 MediumJune 10, 2025
• geoserver GeoServer Coverage REST API Allows Server Side Request Forgery CVE-2024-40625 Fix available 5.5 MediumJune 10, 2025
• geoserver GWC Home Page communicate version and revision information CVE-2024-38524 Fix available 5.3 MediumJune 10, 2025
• geoserver GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) CVE-2024-34711 Fix available 9.3 CriticalJune 10, 2025
• geoserver GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost CVE-2024-29198 Fix available 7.5 HighJune 10, 2025
• geoserver Welcome and About GeoServer pages communicate version and revision information CVE-2024-35230 Fix available 5.3 MediumDecember 16, 2024
• geoserver, geotools +1 more Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver CVE-2024-36401 In KEVPublic exploitFix available EPSS 99.8% 9.8 CriticalJuly 1, 2024
• geoserver GeoServer's Server Status shows sensitive environmental variables and Java properties CVE-2024-34696 Fix available 4.5 MediumJuly 1, 2024
• geoserver Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat CVE-2024-24749 Fix available 7.5 HighJuly 1, 2024
• geoserver GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS) CVE-2024-23821 Fix available 4.8 MediumMarch 20, 2024
• geoserver GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page CVE-2024-23819 Fix available 4.8 MediumMarch 20, 2024
• geoserver GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format CVE-2024-23818 Fix available 4.8 MediumMarch 20, 2024
• geoserver GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form CVE-2024-23643 Fix available 4.8 MediumMarch 20, 2024
• geoserver GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer CVE-2024-23642 Fix available 4.8 MediumMarch 20, 2024
• geoserver GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher CVE-2024-23640 Fix available 4.8 MediumMarch 20, 2024
• geoserver GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API CVE-2024-23634 Fix available 6.0 MediumMarch 20, 2024
• geoserver GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API CVE-2023-51445 Fix available 4.8 MediumMarch 20, 2024
• geoserver GeoServer arbitrary file upload vulnerability in REST Coverage Store API CVE-2023-51444 Public exploitFix available 7.2 HighMarch 20, 2024
• geoserver GeoServer log file path traversal vulnerability CVE-2023-41877 7.2 HighMarch 20, 2024
• geoserver geowebcache GeoServer GeoWebCache rest.html direct request CVE-2023-5786 5.3 MediumOctober 26, 2023
• geoserver WPS Server Side Request Forgery in GeoServer CVE-2023-43795 Fix available EPSS 69.0% 8.6 HighOctober 24, 2023
• geoserver Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer CVE-2023-41339 Fix available 8.6 HighOctober 24, 2023
• geoserver GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language CVE-2023-35042 Fix availableDisputed EPSS 44.8% 9.8 CriticalJune 12, 2023
• geoserver Unfiltered SQL Injection Vulnerabilities in Geoserver CVE-2023-25157 Public exploitFix available EPSS 85.2% 9.8 CriticalFebruary 21, 2023
• geoserver geowebcache Unchecked JNDI lookups in GeoWebCache CVE-2022-24846 9.1 CriticalApril 14, 2022
• geoserver Improper Input Validation in GeoServer CVE-2022-24847 Fix available 7.2 HighApril 13, 2022
• geoserver PartialBufferOutputStream2 flush issues CVE-2008-7227 5.0 MediumSeptember 14, 2009