Geoserver vulnerabilities
31 CVEs and advisories name Geoserver as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-58175GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
- CVE-2025-52465GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
- CVE-2025-27511GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
- CVE-2025-21621GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format
- CVE-2025-58360GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
- CVE-2025-30220GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
- CVE-2025-30145GeoServer has an Infinite Loop Vulnerability in Jiffle process
- CVE-2025-27505GeoServer Missing Authorization on REST API Index
- CVE-2024-40625GeoServer Coverage REST API Allows Server Side Request Forgery
- CVE-2024-38524GWC Home Page communicate version and revision information
- CVE-2024-34711GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
- CVE-2024-29198GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
- CVE-2024-35230Welcome and About GeoServer pages communicate version and revision information
- CVE-2024-36401Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
- CVE-2024-34696 GeoServer's Server Status shows sensitive environmental variables and Java properties
- CVE-2024-24749Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat
- CVE-2024-23821GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)
- CVE-2024-23819GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page
- CVE-2024-23818GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format
- CVE-2024-23643GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form
- CVE-2024-23642GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer
- CVE-2024-23640GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher
- CVE-2024-23634GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API
- CVE-2023-51445GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API
- CVE-2023-51444GeoServer arbitrary file upload vulnerability in REST Coverage Store API
- CVE-2023-41877GeoServer log file path traversal vulnerability
- CVE-2023-5786GeoServer GeoWebCache rest.html direct request
- CVE-2023-43795WPS Server Side Request Forgery in GeoServer
- CVE-2023-41339Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer
- CVE-2023-25157Unfiltered SQL Injection Vulnerabilities in Geoserver