CVE-2025-58360

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.

• CWE-611

• https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOS-11682Issue Tracking
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-58360US Government Resource

Published

Nov 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58355Soft Serve is a self-hostable Git server for the command lin…7.7
• CVE-2025-58356Constellation is the first Confidential Kubernetes. The Cons…8.3
• CVE-2025-583575ire is a cross-platform desktop artificial intelligence ass…9.6
• CVE-2025-58358Markdownify is a Model Context Protocol server for convertin…7.5
• CVE-2025-58359ZF FROST is a Rust implementation of FROST (Flexible Round-O…6
• CVE-2025-5836A vulnerability was found in Tenda AC9 15.03.02.13. It has b…6.3
• CVE-2025-58361Promptcraft Forge Studio is a toolkit for evaluating, optimi…9.3
• CVE-2025-58362Hono is a Web application framework that provides support fo…7.5
• CVE-2025-58364OpenPrinting CUPS is an open source printing system for Linu…6.5
• CVE-2025-58365The XWiki blog application allows users of the XWiki platfor…8.7
• CVE-2025-58366Onyxia is a data science environment for kubernetes. In vers…9.4
• CVE-2025-58367DeepDiff is a project focused on Deep Difference and search …10