Overview
GeoServer is an open source server for sharing geospatial data. The WMS GetMap operation at /geoserver/wms accepts XML in the request body and does not restrict external entity declarations.
An unauthenticated attacker posts XML that defines an external entity and reads local files, reaches internal services, or stalls the server. Fixes shipped in GeoServer 2.25.6, 2.26.2 and 2.27.0. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 11 December 2025.
Affected products
- GeoServer before 2.25.6
- GeoServer 2.26.0 through 2.26.1
Disclosure timeline
- 27 Jan 2025
- GeoServer 2.26.2 released with the fix
- 18 Feb 2025
- GeoServer 2.25.6 released with the fix
- 07 Apr 2025
- GeoServer 2.27.0 released with the fix
- 25 Nov 2025
- GitHub advisory and CVE-2025-58360 published
- 11 Dec 2025
- CISA adds CVE-2025-58360 to the Known Exploited Vulnerabilities catalog