GeoServer vulnerabilities
3 known CVE vulnerabilities in GeoServer, translated and rated.
- CVE-2025-58175Medium
GeoServer prior to versions 2.26.4 and 2.27.3 may allow an attacker to perform unauthenticated Server-Side Request Forgery (SSRF) using `ENTITY_RESOLUTION_ALLOWLIST`. This requires GeoServer to be configured to use a proxy base URL without a path or ending with a slash.
- CVE-2023-35042Critical
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request.
- CVE-2025-52465High
In GeoServer, prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator to pass arbitrary file names to the Master Password Dump web page, potentially creating files containing the master password in plaintext.