CVE-2025-58360: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability. The issue occurs when the application processes XML input through the /geoserver/wms endpoint using the GetMap operation, allowing an attacker to define external entities in the request. This weakness belongs to the class of XML External Entity (XXE) flaws and can expose internal systems or data if exploited.

How it works

The flaw is categorized as CWE-611. GeoServer accepts XML-formatted requests at the specified WMS GetMap endpoint without sufficiently restricting external entity resolution. An attacker supplies a crafted XML document that declares external entities, which the parser may attempt to fetch or resolve during request handling.

Am I affected? How to find it in your systems

GeoServer is typically deployed as a Java-based web application serving geospatial data over HTTP. Inventory running instances by scanning web servers and application containers for the GeoServer WAR or Docker images, then examine enabled services for WMS.

• Review configuration files and endpoint exposure to confirm whether the GetMap operation accepts XML input.
• Check logs for WMS requests containing XML entity declarations or unusual external references.
• Confirm exact affected versions and configurations against the vendor advisory, as no specific version list is provided here.

How to remediate

Apply the vendor-supplied update referenced in the official advisory as the primary step. After patching, review XML parser settings in the application stack and disable external entity resolution for any remaining XML-handling code paths.

• Disable or restrict WMS if the service is not required.
• Apply general hardening for XML inputs, such as configuring parsers to reject external entities and DTDs.

If you can't patch immediately

Segment the GeoServer instance from internal networks and sensitive resources. Place a web application firewall in front of the /geoserver/wms path and create rules to block or sanitize XML requests that contain entity declarations. Monitor inbound traffic and application logs for anomalous XML structures. Consider disabling the WMS service until the update can be applied, following any additional guidance in the vendor advisory or applicable BOD 22-01 requirements for cloud deployments.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to data exposure. Run a free exposure scan of your email addresses against known breach datasets to check for prior incidents.