CISA: Mitigate GeoServer XXE Vulnerability to Prevent Data Theft and Network Scanning

Key Findings

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting the widely used OSGeo GeoServer software to its Known Exploited Vulnerabilities (KEV) Catalog.

• The flaw, tracked as CVE-2025-58360, is an XML External Entity (XXE) vulnerability that attackers are actively exploiting to breach networks and steal sensitive data.

• The vulnerability lies within GeoServer's handling of XML input, allowing attackers to define external entities within the XML request and gain access to arbitrary files, conduct Server-Side Request Forgery (SSRF), and launch Denial of Service (DoS) attacks.

Background

GeoServer is an open-source software server that allows users to share and edit geospatial data. It is widely used by government agencies, organizations, and individuals for various geospatial applications.

Vulnerability Details

• The vulnerability (CVE-2025-58360) is an XXE flaw that affects all versions of GeoServer prior to and including 2.25.5, and from versions 2.26.0 through 2.26.1.

• The flaw exists in the application's handling of XML input through the /geoserver/wms endpoint during GetMap operations.

• Attackers can craft malicious XML requests to trick the server's XML parser into processing external references, leading to a cascade of security failures.

Exploitation and Impact

• Attackers can exploit the vulnerability to read arbitrary files from the server's file system, potentially exposing sensitive data such as configuration files and passwords.

• The flaw also allows for Server-Side Request Forgery (SSRF), enabling attackers to interact with internal systems that are otherwise hidden behind firewalls.

• Attackers can also execute Denial of Service (DoS) attacks by exhausting server resources.

Remediation

• GeoServer maintainers have released updates to address the issue, and administrators are urged to upgrade to GeoServer 2.25.6, 2.26.3, or 2.27.0 immediately.

• Federal Civilian Executive Branch (FCEB) agencies are required to patch their systems by January 1, 2026, to protect federal networks.

Conclusion

The active exploitation of the GeoServer XXE vulnerability (CVE-2025-58360) poses significant risks to organizations using the software. CISA's decision to add it to the KEV Catalog underscores the severity of the issue and the need for prompt remediation to protect networks from data theft, internal scanning, and service disruption.

Sources

• https://securityonline.info/cisa-kev-alert-geoserver-xxe-flaw-under-active-attack-risks-data-theft-internal-network-scanning/

• https://thehackernews.com/2025/12/cisa-flags-actively-exploited-geoserver.html

• https://windowsforum.com/threads/cisa-kev-elevates-geoserver-xxe-flaw-cve-2025-58360-patch-now.393473/latest