OSGeo GeoServer XML External Entity Vulnerability (CVE-2025-58360)

Historical catalog analysis: CISA added this entry on December 11, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-58360 is an Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in OSGeo GeoServer. The flaw exists because the application fails to properly restrict external entity references when processing XML input. This could allow an attacker to define and inject external entities within a crafted XML request.

Exposure and applicability

The vulnerability specifically affects the /geoserver/wms endpoint during the GetMap operation. Organizations deploying OSGeo GeoServer that expose this endpoint to untrusted networks are at higher risk of exposure. Because this involves an open-source component, the vulnerability may also be present in third-party products or libraries that integrate GeoServer functionality.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize actions based on the accessibility of the affected endpoint:

1. Immediate Identification: Locate all instances of OSGeo GeoServer and determine if the /geoserver/wms endpoint is active and reachable.
2. Vendor Mitigation: Apply the specific mitigations provided by the vendor (OSGeo). For those utilizing cloud services, adherence to BOD 22-01 guidance is recommended where applicable.
3. Decommissioning: If vendor mitigations cannot be applied or are unavailable for a specific deployment version, our analysis suggests discontinuing use of the product to eliminate the exposure path.

How to validate remediation

Verification must go beyond a simple version check, as version numbers alone do not prove that the configuration is secure or that the mitigation was successfully deployed in the environment.

Defenders should verify remediation by confirming that the /geoserver/wms endpoint no longer processes external entity references in XML requests. This can be achieved through authorized security testing—such as attempting to trigger an out-of-band interaction via a controlled XML payload—to ensure the parser is correctly configured to ignore or reject external entities.

Limits and open questions

While CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, it remains unknown whether this flaw has been utilized in ransomware campaigns. Additionally, while a federal deadline of 2026-01-01 exists for covered agencies, non-federal organizations must determine their own remediation timelines based on their specific risk tolerance and exposure. Residual risk remains if the product is integrated into larger proprietary systems where vendor patches may not be immediately available or applicable.

Source and editorial note

CVE-2025-58360: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability · Source date: December 11, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 14, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 26, 2026 at 01:10 UTC.

Request a Vulnerability Assessment