What is the CVSS score of EUVD-2025-17683?

EUVD-2025-17683 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 8.4%.

Is there a public PoC exploit available for EUVD-2025-17683?

Yes, a public proof-of-concept exploit is available for EUVD-2025-17683. Prioritise patching immediately. EPSS: 8.4%.

How to fix or mitigate EUVD-2025-17683?

Within 24 hours: Identify all instances of affected GeoServer, GeoTools, and GeoNetwork versions in your environment and assess internet exposure. Within 7 days: Apply vendor patches (GeoServer 2.27.1/2.26.3/2.25.7, GeoTools 33.1/32.3/31.7/28.6.1, GeoNetwork 4.4.8/4.2.13) to all affected systems, prioritizing internet-facing deployments. Within 30 days: Verify patch deployment across the entire estate, validate functionality post-patching, and review logs for exploitation attempts.

Geoserver EUVD-2025-17683

Q: Which versions of Geoserver are affected by EUVD-2025-17683?

A critical XML processing vulnerability (CVE-2025-30220) affects GeoServer, GeoTools, and GeoNetwork installations, allowing remote attackers to extract sensitive data or execute arbitrary code…. A patch is available.

| CVE-2025-30220 CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2025-06-10 security-advisories@github.com

GHSA-jj54-8f66-c5pc

XXE Geonetwork Geoserver Geotools Osgeo

9.9

CVSS 3.1 · GitHub Advisory

View

Vulnerability Assessment

Weakness	CWE CWE-611 OWASP Top 10:2025 A02:2025 - Security Misconfiguration ASVS 5.0 V13 - Configuration XML external entity prevention MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 9.9. EPSS 8.4%. Public PoC/exploit available. Vendor patch available.
Exploit ScenarioDerived	An attacker could exploit this vulnerability in GeoServer to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 8.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

A remote code execution vulnerability in GeoServer (CVSS 9.9) that allows users. Risk factors: public PoC available. Vendor patch is available.

Earlier versions of this analysis (1)

v1 Mar 14, 2026 - 19:49 CVSS 9.9

RemediationAI

Apply the vendor-supplied patch immediately.

Affected VersionsENISA

geoserver 2.26.0, < 2.26.3

geoserver 2.27.0, < 2.27.1

geoserver < 2.25.7

Affected Packages

maven org.geoserver.web:gs-web-app fix: 2.25.7, 2.26.3, 2.27.1

maven org.geoserver:gs-wfs fix: 2.25.7, 2.26.3, 2.27.1

euvd geoserver fix: 2.25.7, 2.26.3, 2.27.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-611 (XML External Entity). CVSS 9.9 indicates critical severity with likely remote exploitation vector. Affects GeoServer.

Know when Geoserver gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.9 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 14, 2026 - 19:49 nvd

Patch available

PoC Detected

Aug 26, 2025 - 16:10 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 16:15 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.

Executive ViewAI

Why It Matters

A critical XML processing vulnerability (CVE-2025-30220) affects GeoServer, GeoTools, and GeoNetwork installations, allowing remote attackers to extract sensitive data or execute arbitrary code through maliciously crafted XML documents. Organizations running these geospatial platforms face immediate risk of data breach and service compromise, particularly if these systems are internet-facing or process untrusted geospatial data.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If patching is delayed: implement WAF rules to block XML external entity payloads in POST/PUT requests to GeoServer endpoints; restrict network access to GeoServer instances using firewall rules; disable XML schema processing features if not business-critical; monitor for XXE exploitation attempts in application logs.

Threat Intelligence Overview

EPSS Score

8.4%

Top 8% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS POC (1)

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 8.4%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.