GeoServer CVE-2025-58360

No special conditions beyond network reachability of the GeoServer WMS service - remote unauthenticated exploitation (PR:N) against affected versions (2.26.0 to before 2.26.2, and all versions before 2.25.6) via the /geoserver/wms GetMap operation, which accepts attacker-supplied XML processed by a parser that does not disable external entity resolution. The required prerequisite is simply that the GeoServer WMS endpoint is accessible to the attacker; impact is amplified when the server has readable sensitive files or network paths to internal systems for SSRF. Limiting factors: only in-range versions are vulnerable, and SSRF/file-read value depends on the server's filesystem contents and internal network exposure.

All signals align toward genuine high priority with no significant conflicts. CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated attack against the /geoserver/wms GetMap endpoint, and the GHSA advisory explicitly confirms the attack is unauthenticated. This is reinforced by an EPSS score of 85.99% (99th percentile), indicating very high likelihood of exploitation activity, and by CISA KEV listing (confirmed actively exploited in the wild), plus publicly available exploit code. The convergence of KEV + high EPSS + public POC + unauthenticated network vector makes this a real, actionable priority rather than a high-CVSS-but-low-real-risk issue. One caveat on impact ratings: the input assigns C:H/I:H/A:H, but a classic XXE primarily yields confidentiality impact (arbitrary file read) and availability impact (resource-exhaustion DoS); the integrity (I:H) rating is not well-supported by the described primitives (file read, SSRF, DoS do not inherently modify server data) - verify integrity impact with the vendor. The SSRF capability may also cross a security boundary, arguing for a scope change the input vector does not capture.

A remote, unauthenticated attacker sends a crafted XML GetMap request to a public-facing /geoserver/wms endpoint containing a malicious external entity declaration. The weakly configured XML parser resolves the entity, letting the attacker read sensitive files (e.g., credentials or configuration) off the server filesystem or pivot via SSRF into internal network services. Publicly available exploit code exists and the flaw is confirmed actively exploited per CISA KEV, so weaponization requires minimal effort.