CVE Feed

    Dashboard / CVE / CVE-2025-30220

    CVE-2025-30220

    GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.

    Published:Jun 10, 2025
    Last Modified:Aug 26, 2025
    EPS:Jun 10, 2025
    EPSS Score:0.04607
    CVSS Score:9.9

    Affected Products

    Vendor
    Geonetwork
    Product
    Opensource
    Vendor
    Geonetwork-opensource
    Product
    Geonetwork
    Vendor
    Geoserver
    Product
    Geoserver
    Vendor
    Geotools
    Product
    Geotools
    Vendor
    Osgeo
    Product
    Geonetwork
    Vendor
    Osgeo
    Product
    Geoserver

    Exploits

    https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-221 Data Serialization External Entities Blowup
    CAPEC-664 Server Side Request Forgery

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High