CVE-2025-58360: OSGeo GeoServer WMS GetMap XXE (KEV)

CVE-2025-58360 is an XML External Entity (XXE) injection in GeoServer's WMS GetMap endpoint: because the endpoint accepts XML input without sufficiently restricting external entity resolution, a remote attacker with no credentials can craft a request that reads arbitrary files from the server's filesystem, triggers outbound server-side request forgery, or crashes the server, and it was later added to CISA's KEV catalog.

CVE-2025-58360 is an XML External Entity (XXE, CWE-611) vulnerability in GeoServer, the widely used open-source server for sharing and editing geospatial data that underpins many government, utility and GIS web-mapping deployments. NVD's description states: "the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request" (NVD).

GeoServer's own GitHub security advisory (GHSA-fjf5-xgmq-5525) confirms the flaw lets an attacker "read arbitrary files from the server's file system," and separately enables server-side request forgery or denial-of-service, requiring no authentication or user interaction to trigger (GeoServer GHSA-fjf5-xgmq-5525).

NVD's own analysis assigns a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD) — notably higher than GeoServer's own GitHub-submitted Secondary score of 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L), which rates integrity impact as none and availability impact as low rather than high. Operators should treat the NVD-confirmed 9.8 as the authoritative figure for prioritization, since it reflects the worst-case impact an XXE payload can reach (e.g. chaining file reads into further compromise), not just the vendor's narrower direct-impact assessment.

The flaw affects GeoServer versions before 2.25.6 and the 2.26.0-2.26.1 range; it is fixed in GeoServer 2.25.6, 2.26.2, and 2.27.0 (NVD; GeoServer GHSA-fjf5-xgmq-5525).

CISA added CVE-2025-58360 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-12-11, with a required-action due date of 2026-01-01; known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.61169 (99.159th percentile) — a high figure consistent with mass scanning of internet-facing GeoServer instances, which have a long history of being targeted shortly after disclosure (FIRST EPSS).

Any internet-facing GeoServer instance below the fixed builds above should be upgraded immediately; because XXE can expose configuration files, credentials or internal network endpoints, instances that cannot be patched promptly should be taken off the public internet and checked for signs of prior file-read or SSRF activity in request logs.

• The /geoserver/wms GetMap operation accepts XML input without sufficiently restricting external entity resolution, letting an attacker define external entities in the request. — NVD
• GeoServer's own advisory confirms the flaw allows reading arbitrary files from the server's filesystem, plus SSRF/DoS, with no authentication or user interaction required. — GeoServer GHSA-fjf5-xgmq-5525
• NVD Primary CVSS v3.1 is 9.8 (critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, higher than GeoServer's own Secondary score of 8.2 (C:H/I:N/A:L). — NVD
• Affected: GeoServer before 2.25.6 and 2.26.0-2.26.1; fixed in 2.25.6, 2.26.2, or 2.27.0. — GeoServer GHSA-fjf5-xgmq-5525
• Added to the CISA KEV catalog on 2025-12-11, due date 2026-01-01; known ransomware-campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.61169 (99.159th percentile) as of 2026-10-29. — FIRST EPSS