CVE-2025-30220 in GeoServer
Summary
by MITRE • 06/10/2025
GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/10/2025
The vulnerability identified as CVE-2025-30220 affects GeoServer, an open source geospatial data server that enables users to share and edit spatial data through standardized protocols. This security flaw resides within the GeoTools library components, specifically within the Schema class that utilizes the Eclipse XSD library for representing schema data structures. The vulnerability stems from improper handling of XML external entity processing, creating potential attack vectors for malicious actors to exploit during XML document parsing operations.
The technical flaw manifests in the gt-xsd-core Schemas class implementation which fails to properly utilize the EntityResolver mechanism that should be provided by the ParserHandler when configured. This omission allows XML parsers to process external entity references without proper validation or restriction, enabling attackers to craft malicious XML documents that can trigger unauthorized resource access. The vulnerability specifically impacts systems where XML processing involves gt-xsd-core components during schema parsing operations, particularly when documents contain references to external XML schemas. Additionally, the issue extends to users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter is not being properly implemented as intended, creating additional attack surfaces.
The operational impact of this vulnerability is significant for organizations relying on GeoServer for geospatial data management and sharing. Attackers could potentially leverage this XXE vulnerability to perform server-side request forgery attacks, access internal network resources, conduct denial of service operations, or even escalate privileges within affected systems. The vulnerability affects critical components used in geospatial data workflows, making it particularly dangerous for organizations managing sensitive spatial data. The exploitation could lead to unauthorized data access, system compromise, or disruption of geospatial services that many organizations depend upon for critical operations.
Mitigation strategies should prioritize immediate deployment of patched versions including GeoTools 33.1, 32.3, 31.7, and 28.6.1, along with GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13. Organizations should also implement proper XML parser configurations that disable external entity processing and restrict access to external resources. Security practitioners should review and validate all XML processing components within their geospatial infrastructure, particularly those involving schema validation and data parsing operations. The vulnerability aligns with CWE-611 (Improper Restriction of XML External Entity Reference) and represents a significant risk under ATT&CK technique T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter) frameworks, emphasizing the need for comprehensive security hardening of geospatial data platforms.