Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.geoserver.web:gs-web-sec-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.2MavenPublished

    GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

    CVE-2025-52465 · GHSA-7qmg-grcp-qf25

    Affected
    • Maven org.geoserver.web:gs-web-sec-core >= 2.27.0, <= 2.27.2; <= 2.26.3
    Fixed in
    2.27.32.26.4· Vendor fix available
    Issue
    A vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Details When dumping the master password, GeoServer will use the provided file name with minimal validation as long as it is a java.io.File path. The only limitation is that the fix for a previous, unrelated vulnerability prevents relative path traversal here but absolute paths can be used to access arbitrary files. GeoServer does not enforce a maximum password length by default which allows an administrator to place malicious code into their password which could then be dumped into a JSP file. Impact Remote Code Execution (High severity) This vulnerability can lead to executing arbitrary code…

    Recommended action: Upgrade to 2.27.3 or 2.26.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →