Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.geoserver.web:gs-web-app

15 known vulnerabilities (3 critical, 5 high, 7 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
15 · 3 critical, 5 high, 7 medium
Registry
Maven Central

Advisories 15

  • CVE-2025-58175Medium 6.5

    GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

    Affected: fixed in 2.26.4; from 2.27.0, fixed in 2.27.3.

  • GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

    Affected: from 2.27.0, fixed in 2.27.3; fixed in 2.26.4.

  • CVE-2025-21621Medium 6.1

    GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format

    Affected: fixed in 2.25.0.

  • CVE-2025-58360High 8.2 · KEV

    GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

    Affected: from 2.26.0, fixed in 2.26.2; fixed in 2.25.6.

  • CVE-2025-30220Critical 9.9

    GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

    Affected: from 2.27.0, fixed in 2.27.1; from 2.26.0, fixed in 2.26.3; fixed in 2.25.7.

  • GeoServer has an Infinite Loop Vulnerability in Jiffle process

    Affected: from 2.26.0, fixed in 2.26.3; fixed in 2.25.7.

  • CVE-2025-27505Medium 5.3

    GeoServer Missing Authorization on REST API Index

    Affected: from 2.26.0, fixed in 2.26.3; fixed in 2.25.6.

  • CVE-2024-40625Medium 5.5

    GeoServer Coverage REST API Allows Server Side Request Forgery

    Affected: fixed in 2.26.0.

  • CVE-2024-38524Medium 5.3

    GWC Home Page communicate version and revision information

    Affected: from 2.26.0, fixed in 2.26.2; fixed in 2.25.6.

  • CVE-2024-34711Critical 9.3

    GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

    Affected: fixed in 2.25.0.

  • CVE-2024-35230Medium 5.3

    Welcome and About GeoServer pages communicate version and revision information

    Affected: from 2.0.0, fixed in 2.25.1.

  • CVE-2024-36401Critical 9.8 · KEV

    Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

    Affected: from 2.24.0, fixed in 2.24.4; from 2.25.0, fixed in 2.25.2; from 2.23.0, fixed in 2.23.6; fixed in 2.22.6.

  • CVE-2024-34696Medium 4.5

    GeoServer's Server Status shows sensitive environmental variables and Java properties

    Affected: from 2.10.0, fixed in 2.24.4; from 2.25.0, fixed in 2.25.1.

  • Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

    Affected: fixed in 2.23.5; from 2.24.0, fixed in 2.24.3.

  • Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

    Affected: fixed in 2.22.5; from 2.23.0, fixed in 2.23.2.