EUVD-2025-210276
GHSA-g628-r368-6vh7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain GeoServer admin credentials
-
DeliveryReach admin UI over network
-
ExploitSubmit malicious DB2 JDBC URL on Vector Data Sources page
-
ExecutionTrigger JNDI lookup to attacker LDAP server
-
PersistDeserialize gadget payload
-
ImpactExecute arbitrary code as GeoServer user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires (1) GeoServer with the optional gs-db2 extension installed and loaded, (2) an authenticated administrator account with permission to create or edit Vector Data Sources, and (3) outbound network reachability from the GeoServer host to an attacker-controlled JNDI/LDAP/RMI endpoint so the JDBC driver can fetch the malicious object. Limiting factors: the DB2 extension is not part of a default GeoServer install, admin-level credentials are needed (CVSS PR:H), no user interaction by another victim is required, and egress filtering or a recent JDK with restrictive JNDI defaults can blunt the deserialization step. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) accurately captures that exploitation is network-reachable and low-complexity once the attacker possesses high privileges - specifically an administrator account on a GeoServer instance with the optional DB2 extension installed. There is no CISA KEV listing and no public POC has been identified at time of analysis, so this should not be treated as a drop-everything emergency. However, GeoServer has a track record of post-authentication RCEs being chained with credential exposure or default/weak admin credentials on internet-facing deployments, and JNDI-deserialization RCEs are highly reliable once reachable. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quoted; prioritize patching where the DB2 extension is loaded and admin UI is accessible beyond a trusted network. |
| Exploit ScenarioDerived | An attacker who has obtained GeoServer administrator credentials (via phishing, credential reuse, default passwords on an exposed instance, or chaining a separate auth bypass) navigates to the Vector Data Sources page, creates a new DB2 store, and supplies a JDBC URL whose connection parameters point the driver to an attacker-controlled JNDI/LDAP endpoint. When GeoServer attempts to test or open the connection, the DB2 driver performs a JNDI lookup, deserializes the attacker-hosted object, and executes a gadget chain that runs arbitrary code as the GeoServer process user. No public POC has been identified at time of analysis, but the technique is well documented from prior JDBC-JNDI RCEs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 11, 2026
Remote code execution in GeoServer (versions prior to 2.27.0) with the DB2 extension installed allows authenticated administrators to perform a JNDI injection attack via a crafted DB2 JDBC connection URL submitted through the Vector Data Sources page, ultimately triggering Java deserialization of untrusted data and arbitrary code execution. No public exploit identified at time of analysis, and the vulnerability is not on CISA KEV, but the attack pattern follows well-known JNDI/Log4Shell-style RCE techniques. Risk is meaningful only where the DB2 extension is deployed and an administrative account is reachable.
RemediationAI
Upgrade to GeoServer 2.27.0 or later, which restricts the connection parameters accepted by the DB2 data store and is the vendor-released patch (https://github.com/geoserver/geoserver/releases/tag/2.27.0, GHSA-g628-r368-6vh7). Where immediate upgrade is not feasible, remove the gs-db2 extension JARs from the GeoServer WEB-INF/lib directory to eliminate the vulnerable code path - note this disables all DB2 data stores and any layers depending on them. As a compensating control, restrict access to the GeoServer admin web UI (typically /geoserver/web) to a management VLAN or VPN, enforce strong unique administrator credentials, and disable any unused administrator accounts so that the PR:H precondition cannot be trivially satisfied. Setting the JVM property com.sun.jndi.ldap.object.trustURLCodebase=false (and the rmi equivalent) on modern JDKs reduces JNDI gadget reachability but is not a complete fix because deserialization can still occur via other classpath gadgets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GeoServer is an open-source Java server (built on GeoTools) for publishing geospatial data via OGC standards (WMS, WFS, WCS, etc.). The DB2 DataStore extension (Maven artifact org.geoserver.extension:gs-db2) registers a Vector Data Source backed by an IBM DB2 JDBC connection. The flaw is a CWE-74 injection: the extension does not restrict dangerous JDBC connection parameters, so an attacker can include JNDI-related parameters (e.g., directing the driver to a remote LDAP/RMI URL) that cause the JDBC layer to perform a JNDI lookup. The returned object is deserialized by the Java runtime, enabling arbitrary code execution via known gadget chains - the same root cause class as CVE-2023-27867 referenced in the advisory.
Know when Atlassian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Admin-only web UI action over network (AV:N, PR:H), no victim interaction (UI:N), reliable JNDI/deserialization gadget yields full RCE on the GeoServer process (C/I/A:H).
Primary rating from Vendor (https://github.com/geoserver/geoserver).
CVSS VectorVendor: https://github.com/geoserver/geoserver
DescriptionCVE.org
Summary
Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution (RCE).
Impact
If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code.
Details
Authenticated users can access Vector Data Sources page to creating a new data store through db2 jdbc connection, performing JNDI attack due to unrestricted connection parameters, and then achieve RCE with deserialization of untrusted data.
Remediation
This issue has been fixed in this release: https://github.com/geoserver/geoserver/releases/tag/2.27.0.
References
- https://osgeo-org.atlassian.net/browse/GEOT-7725
- https://nvd.nist.gov/vuln/detail/cve-2023-27867
Executive ViewAI
Organizations using GeoServer with the DB2 extension face a remote code execution vulnerability in all versions before 2.27.0; while no public exploit has been identified at time of analysis, the vulnerability could be exploited by compromised administrators to gain unauthorized system access. The vendor has not yet released a security patch, requiring immediate implementation of administrative access controls as the primary interim defense. Any GeoServer deployment with DB2 capability should be treated as high-priority until patching becomes available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce multi-factor authentication and strong password policies for all GeoServer administrative accounts; (2) Restrict administrative access to GeoServer to trusted internal networks via firewall rules; (3) Disable the DB2 extension entirely if not required for operations; (4) Implement enhanced logging and monitoring for administrative activity and JNDI connection attempts, with alerts for suspicious patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java
Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName p
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef
Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers t
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. Rated critic
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Rated
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
Exploit-DB