GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
geoserver · geoserver
The XML External Entity (XXE) flaw lives in GeoTools' gt-xsd-core component, which GeoServer and GeoNetwork use for XML schema parsing: the Schemas class ignores the EntityResolver supplied by the parser handler, and the gt-wfs-ng DataStore does not honour its ENTITY_RESOLVER connection parameter. An attacker who can send network requests to an exposed XML-processing endpoint with a document that references an external schema can cause the server to resolve attacker-chosen external entities, with no authentication or user interaction required.
GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 42 days after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+42 days
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
4 fixes in gs-wfs over 24 months. The latest fix listed for gs-wfs is 2.27.1.
Fixes in gs-wfsMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 2.20.4CVE-2023-3504212 Jun 2023
- 2.25.2CVE-2024-364011 Jul 2024KEV
- 2.25.2CVE-2024-2919810 Jun 2025
- 2.27.1CVE-2025-3022010 Jun 2025Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.geoserver.web:gs-web-appAffected: 2.27.0 up to 2.27.1; 2.26.0 up to 2.26.3; All versions before 2.25.7Upgrade to 2.27.1 or later (older lines: 2.26.3, 2.25.7)
- Mavenorg.geoserver:gs-wfsAffected: 2.27.0 up to 2.27.1; 2.26.0 up to 2.26.3; All versions before 2.25.7Upgrade to 2.27.1 or later (older lines: 2.26.3, 2.25.7)