GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

Summary

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.

Timeline

1. Jun 10, 2025, 3:16 PM UTCCVE published
2. Jun 10, 2025, 5:13 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Jun 10, 2025, 5:13 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• geoserver geoserver

  From 2.27.0 · fixed in 2.27.1; From 2.26.0 · fixed in 2.26.3; fixed in 2.25.7

• org.geoserver.web:gs-web-appMaven

  From 2.27.0 · fixed in 2.27.1

• org.geoserver:gs-wfsMaven

  From 2.27.0 · fixed in 2.27.1

• org.geoserver.web:gs-web-appMaven

  From 2.26.0 · fixed in 2.26.3

• org.geoserver:gs-wfsMaven

  From 2.26.0 · fixed in 2.26.3

• org.geoserver.web:gs-web-appMaven

  fixed in 2.25.7

• org.geoserver:gs-wfsMaven

  fixed in 2.25.7

References 8