← Vulnerability feed

Vulnerability record · CVE-2025-27511 · published 18 June 2026

CVE-2025-27511: Osgeo geoserver injection vulnerability

Osgeo · Geoserver

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

7.2 CVSS 3.1 High EPSS 1.1% · top 36.4% CWE-74 · InjectionCWE-502 · Deserialization of untrusted data
7.2CVSS 3.1 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
24 Jun 2026Last modified by NVD

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/geoserver/geoserver/releases/tag/2.27.0 ProductRelease Notes
https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7 Vendor Advisory
https://nvd.nist.gov/vuln/detail/cve-2023-27867 Not Applicable
https://osgeo-org.atlassian.net/browse/GEOT-7725 Issue Tracking

Track CVE-2025-27511 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-43795GeoServer WPS server-side request forgeryGeoServer's OGC Web Processing Service (WPS) accepts GET and POST requests and does not adequately restrict the targets it fetches, allowing server-s…EPSS 68%analysed9.8CVE-2023-25157GeoServer OGC filter SQL injection via CQL and PostGIS datastoreGeoServer supports the OGC Filter expression language and CQL through WFS, WMS and WCS, and mishandles certain filter constructs when a PostGIS datas…EPSS 85%analysed9.1CVE-2025-30220Geotools xml external entity (xxe) vulnerabilityGeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent…EPSS 42%8.2CVE-2025-58175Osgeo geoserver improper input validation vulnerabilityGeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `E…EPSS 0.47%8.2CVE-2024-29198Osgeo geoserver server-side request forgery (ssrf) vulnerabilityGeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side …EPSS 2.3%8.2CVE-2024-34711Osgeo geoserver information exposure vulnerabilityGeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables …EPSS 0.30%7.5CVE-2025-30145Osgeo geoserver vulnerabilityGeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either…EPSS 0.51%7.5CVE-2024-38524Osgeo geoserver information exposure vulnerabilityGeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpSer…EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2025-27511), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.