GeoServer versions prior to < 2.25.6, 2.26.x < 2.26.2 are affected by an XML External Entity (XXE) vulnerability. An attacker could exploit this vulnerability by sending a specially crafted XML request to the GeoServer instance, which could lead to unauthorized access to sensitive data, server-side request forgery (SSRF), or denial of service (DoS) attacks.

< 2.25.6、2.26.x < 2.26.2 より前のバージョンの GeoServer は、XML 外部エンティティ (XXE) 脆弱性の影響を受けます。攻撃者がこの脆弱性を悪用して、特別に細工された XML リクエストを GeoServer インスタンスに送信することで、秘密データへの不正アクセス、サーバーサイドリクエストフォージェリ (SSRF)、サービス拒否 (DoS) 攻撃を引き起こす可能性があります。

GeoServer < 2.25.6、2.26.x < 2.26.2 版本受到 XML 外部实体 (XXE) 漏洞影响。攻击者可通过向 GeoServer 实例发送特制的 XML 请求来利用此漏洞，这可导致对敏感数据进行未经授权的访问、服务器端请求伪造 (SSRF) 或拒绝服务 (DoS) 攻击。

GeoServer < 2.25.6、2.26.x < 2.26.2 版本受到 XML 外部實體 (XXE) 弱點影響。攻擊者可藉由傳送特製的 XML 要求至 GeoServer 執行個體來刺探利用此弱點，這可導致未經授權存取敏感資料、伺服器端要求偽造 (SSRF) 或拒絕服務 (DoS) 攻擊。

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GeoServer is an open source server that allows users to share and edit geospatial data. From version
    2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The
    application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this
    input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within
    the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
    (CVE-2025-58360)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
115075	GeoServer < 2.25.6 / 2.26.x < 2.26.2 XML External Entity	Web App Scanning	Component Vulnerability	2025/12/11	2025/12/11	critical
115075	GeoServer < 2.25.6 / 2.26.x < 2.26.2 XML 外部エンティティ	Web App Scanning	Component Vulnerability	2025/12/11	2025/12/11	critical
115075	GeoServer < 2.25.6 / 2.26.x < 2.26.2 XML 外部实体	Web App Scanning	Component Vulnerability	2025/12/11	2025/12/11	critical
115075	GeoServer < 2.25.6 / 2.26.x < 2.26.2 XML 外部實體	Web App Scanning	Component Vulnerability	2025/12/11	2025/12/11	critical
436173	SCA: security update for org.geoserver.web:gs-web-app, org.geoserver:gs-wms (GHSA-fjf5-xgmq-5525)	Tenable Cloud Security	SCA Checks	2025/11/26	2026/7/2	critical
436173	SCA: security update for org.geoserver.web:gs-web-app, org.geoserver:gs-wms (GHSA-fjf5-xgmq-5525)	Tenable Self-Hosted Container Security	SCA Checks	2025/11/26	2026/7/2	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical