Vendor

    GeoServer

    34 known vulnerabilities in products by GeoServer, 2 of them actively exploited (CISA KEV).

    Key figures

    34

    Vulnerabilities

    2

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in GeoServer
    CriticalCVE-2024-36401

    Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

    In CISA KEValso in 1 other product

    		9.8
    CriticalCVE-2025-58360

    OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

    In CISA KEV

    		8.2
    CriticalCVE-2025-30220

    OSGeo GeoServer: Improper Restriction of XML External Entity Reference

    also in 3 other products

    		9.9
    CriticalCVE-2023-25157

    Unfiltered SQL Injection Vulnerabilities in Geoserver

    also in 1 other product

    		9.8
    CriticalCVE-2023-35042

    OSGeo GeoServer: Code Execution

    		9.8
    CriticalCVE-2023-43795

    WPS Server Side Request Forgery in GeoServer

    also in 1 other product

    		8.6
    HighCVE-2024-29198

    GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

    also in 1 other product

    		7.5
    HighCVE-2023-51444

    GeoServer arbitrary file upload vulnerability in REST Coverage Store API

    		7.2
    HighCVE-2025-27511

    GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

    also in 2 other products

    		7.2
    CriticalCVE-2022-24846

    Unchecked JNDI lookups in GeoWebCache

    		9.1
    HighCVE-2022-24847

    Improper Input Validation in GeoServer

    also in 1 other product

    		7.2
    HighCVE-2025-52465

    GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

    also in 3 other products

    		7.2
    MediumCVE-2025-27505

    GeoServer Missing Authorization on REST API Index

    also in 1 other product

    		5.3
    HighCVE-2023-41877

    GeoServer log file path traversal vulnerability

    		7.2
    HighCVE-2024-24749

    Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

    		7.5
    HighCVE-2023-41339

    Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

    also in 1 other product

    		8.6
    HighCVE-2025-30145

    GeoServer has an Infinite Loop Vulnerability in Jiffle process

    also in 1 other product

    		7.5
    HighCVE-2023-5786

    GeoServer GeoWebCache rest.html direct request

    		5.3
    CriticalCVE-2024-34711

    GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

    also in 1 other product

    		9.3
    MediumCVE-2024-23634

    GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API

    		6.0
    MediumCVE-2024-35230

    Welcome and About GeoServer pages communicate version and revision information

    also in 1 other product

    		5.3
    HighCVE-2025-58175

    GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

    also in 3 other products

    		6.5
    MediumCVE-2025-21621

    GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format

    		6.1
    HighCVE-2024-38524

    GWC Home Page communicate version and revision information

    also in 1 other product

    		5.3
    MediumCVE-2024-40625

    GeoServer Coverage REST API Allows Server Side Request Forgery

    also in 1 other product

    		5.5

    All vulnerabilities in search

    Products

    Products by GeoServer
    OSGeo GeoServer292