Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint. Mitigation To manage the proxy base value as a system administrator, use the parameter PROXYBASEURL to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith. Resolution The TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript Demo Requests page to test OGC Web Services. References CVE-2024-29198 Unauthenticated SSRF via TestWfsPost
Recommended action: Upgrade to 2.25.2 or 2.24.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GeoServer Web Feature Service (WFS) web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity (XXE) processing attack. It is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers. This allows for Out-of-Band (OOB) data exfiltration of local files accessible by the GeoServer process, and Service Side Request Forgery (SSRF). Details While direct entity resolution is managed by application property ENTITYRESOLUTIONALLOWLIST for XML Parsing, this restriction was not being used by the GeoTools library when building an in-memory XSD Library Schema representation. This bypasses GeoServer's AllowListEntityResolver enabling XXE attacks. PoC No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS service. Impact Information Disclosure: This vulnerability allows unauthenticated attackers to read arbitrary files from the server's filesystem that are accessible to the…
Recommended action: Upgrade to 2.27.1, 2.26.3 or 2.25.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Details A unauthenticated user can supply a request that will be issued by the server. This can be used to enumerate internal networks and also in the case of cloud instances can be used to obtain sensitive data. Mitigation 1. When using GeoServer with a proxy, manage the proxy base value as a system administrator, use the application property PROXYBASEURL to provide a non-empty value that cannot be overridden by the user interface or incoming request. 2. When using GeoServer directly without a proxy, block all access to TestWfsPost by editing the web.xml file. Adding this block right before the end: Resolution Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue. The demo request page functionality is now implemented directly in the browser. Reference - https://osgeo-org.atlassian.net/browse/GEOS-11794 -…
Recommended action: Upgrade to 2.25.2 or 2.24.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. Details The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to ALL GeoServer instances. PoC No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. Impact This vulnerability can lead to executing arbitrary code.…
Recommended action: Upgrade to 2.25.2, 2.24.4, 2.23.6 or 2.22.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. RCE in Jiffle The Jiffle map algebra language, provided by jai-ext, allows efficiently execute map algebra over large images. A vulnerability CVE-2022-24816 has been recently found in Jiffle, that allows a Code Injection to be performed by properly crafting a Jiffle invocation. In the case of GeoServer, the injection can be performed from a remote request. Assessment GeoTools includes the Jiffle language as part of the gt-process-raster-<version module, applications using it should check whether it’s possible to provide a Jiffle script from remote, and if so, upgrade or remove the functionality (see also the GeoServer mitigation, below). The issue is of particular interest for GeoServer users, as GeoServer embeds Jiffle in the base WAR package. Jiffle is available as a OGC…
Recommended action: Upgrade to 2.20.4, 2.19.6 or 2.18.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.