by Kastro
Paper/Archive/CVE-2025-30220

CVE-2025-30220

geoserver geoserver — GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

EPSS 42%CVSS 9.9
critical.is priorityof 100
49
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 98.7.987 × 2019.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.

Affected

ProductAffectedFixed inSource
geoserver>= 2.27.0, < 2.27.1–CNA
geoserver>= 2.26.0, < 2.26.3–CNA
geoserver< 2.25.7–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pcrefgithub.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvcrefgithub.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vwrefgithub.com/geonetwork/core-geonetwork/pull/8757refgithub.com/geonetwork/core-geonetwork/pull/8803refgithub.com/geonetwork/core-geonetwork/pull/8812refdocs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities