CVE-2025-58360 OSGeo GeoServer
OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.
- CVSS
- not scored
On CISA’s exploited list
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
- Added
- 2025-12-11
- Federal patch deadline
- 2026-01-01
- Ransomware use
- not known