Overview
GeoTools is the Java library under GeoServer and GeoNetwork. Its gt-xsd-core Schemas class loads XML schemas through the Eclipse XSD library and ignores the EntityResolver that the parser was configured with. Any document that references an external schema reaches the parser with entity resolution left open.
An unauthenticated attacker sends XML with an external entity to a GeoServer WFS endpoint, or to any application that parses XML through gt-xsd-core, and reads files or makes requests from the server. The gt-wfs-ng DataStore is also affected because its ENTITY_RESOLVER parameter was not applied. Fixes shipped across GeoTools, GeoServer and GeoNetwork on 10 June 2025.
Affected products
- GeoTools before 28.6.1, 29.0 through 31.6, 32.0 through 32.2, and 33.0
- GeoServer before 2.25.7, 2.26.0 through 2.26.2, and 2.27.0
- GeoNetwork 4.2.0 through 4.2.12 and 4.4.0 through 4.4.7
Disclosure timeline
- 18 Mar 2025
- CVE-2025-30220 reserved
- 14 May 2025
- GeoServer 2.27.1, 2.26.3 and 2.25.7 released with the fix
- 10 Jun 2025
- Coordinated advisories and CVE published for GeoTools, GeoServer and GeoNetwork