{"id":"CVE-2025-30220","published":"2025-06-10T15:16:39Z","modified":"2025-06-10T17:13:09Z","title":"GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling","vendor":"geoserver","product":"geoserver","tier":"core","eol":null,"affectedVersions":[{"vendor":"geoserver","product":"geoserver","versions":[">= 2.27.0, < 2.27.1",">= 2.26.0, < 2.26.3","< 2.25.7"]}],"description":{"text":"GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.","provenance":"source","from":"CVE.org"},"summary":{"text":"The XML External Entity (XXE) flaw lives in GeoTools' gt-xsd-core component, which GeoServer and GeoNetwork use for XML schema parsing: the Schemas class ignores the EntityResolver supplied by the parser handler, and the gt-wfs-ng DataStore does not honour its ENTITY_RESOLVER connection parameter. An attacker who can send network requests to an exposed XML-processing endpoint with a document that references an external schema can cause the server to resolve attacker-chosen external entities, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:54Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.42285,"percentile":0.98698,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-07-22","exploitedFirstSeen":"2025-07-22","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-22&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-23&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-24&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-25&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-26&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-27&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-28&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-29&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-30&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-31&host_type=src&vulnerability=cve-2025-30220","date":"2025-07-31"}],"evidenceTotal":107,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"},{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc","tags":["x_refsource_MISC"]},{"url":"https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw","tags":["x_refsource_MISC"]},{"url":"https://github.com/geonetwork/core-geonetwork/pull/8757","tags":["x_refsource_MISC"]},{"url":"https://github.com/geonetwork/core-geonetwork/pull/8803","tags":["x_refsource_MISC"]},{"url":"https://github.com/geonetwork/core-geonetwork/pull/8812","tags":["x_refsource_MISC"]},{"url":"https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","vulnerableRanges":[">=2.27.0, <2.27.1",">=2.26.0, <2.26.3","<2.25.7"],"patched":["2.27.1","2.26.3","2.25.7"],"from":["GHSA-jj54-8f66-c5pc"],"provenance":"source"},{"ecosystem":"Maven","package":"org.geoserver:gs-wfs","vulnerableRanges":[">=2.27.0, <2.27.1",">=2.26.0, <2.26.3","<2.25.7"],"patched":["2.27.1","2.26.3","2.25.7"],"from":["GHSA-jj54-8f66-c5pc"],"provenance":"source"}],"advisories":[{"id":"GHSA-jj54-8f66-c5pc","url":"https://github.com/advisories/GHSA-jj54-8f66-c5pc","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","vulnerableRanges":[">=2.27.0, <2.27.1"],"patched":["2.27.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jj54-8f66-c5pc","url":"https://github.com/advisories/GHSA-jj54-8f66-c5pc","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver:gs-wfs","vulnerableRanges":[">=2.27.0, <2.27.1"],"patched":["2.27.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jj54-8f66-c5pc","url":"https://github.com/advisories/GHSA-jj54-8f66-c5pc","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","vulnerableRanges":[">=2.26.0, <2.26.3"],"patched":["2.26.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jj54-8f66-c5pc","url":"https://github.com/advisories/GHSA-jj54-8f66-c5pc","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver:gs-wfs","vulnerableRanges":[">=2.26.0, <2.26.3"],"patched":["2.26.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jj54-8f66-c5pc","url":"https://github.com/advisories/GHSA-jj54-8f66-c5pc","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver.web:gs-web-app","vulnerableRanges":["<2.25.7"],"patched":["2.25.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jj54-8f66-c5pc","url":"https://github.com/advisories/GHSA-jj54-8f66-c5pc","severity":"HIGH","ecosystem":"Maven","package":"org.geoserver:gs-wfs","vulnerableRanges":["<2.25.7"],"patched":["2.25.7"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-17683","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-17683","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-30220","name":"GeoServer WFS - XXE Processing Vulnerability","severity":"critical","path":"http/cves/2025/CVE-2025-30220.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30220.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-06-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-30220","provenance":"source"},{"date":"2025-07-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-22&host_type=src&vulnerability=cve-2025-30220","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 466 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.74,"detail":"percentile 0.9870"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2023-35042","published":"2023-06-12","fixed":"2.20.4","kev":false},{"cve":"CVE-2024-29198","published":"2025-06-10","fixed":"2.25.2","kev":false,"link":{"from":"CVE-2024-29198","to":"CVE-2025-30220","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.geoserver:gs-wfs","fromFixed":"2.25.2","toFixed":"2.25.7","daysApart":0}]}},{"cve":"CVE-2024-36401","published":"2024-07-01","fixed":"2.25.2","kev":true},{"cve":"CVE-2025-30220","published":"2025-06-10","fixed":"2.27.1","kev":false}],"package":"Maven:org.geoserver:gs-wfs"}}