# CVE-2025-58360: GeoServer - XXE

> Live exploitation tracking for CVE-2025-58360 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-58360

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 8.2
- **Public exploit available:** Yes
- **Affected products:** GeoServer
- **Weaknesses:** CWE-611 (Improper Restriction of XML External Entity Reference)
- **Tags:** web_application

## Description

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.

## CrowdSec analysis

[CVE-2025-58360](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-58360) is an XML External Entity (XXE) vulnerability in GeoServer versions 2.26.0 to before 2.26.2 and before 2.25.6, which allows attackers to exploit unsanitized XML input via the /geoserver/wms GetMap operation. This flaw could enable remote attackers to access sensitive files or internal resources on the server, potentially leading to information disclosure or limited denial of service.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-58360 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
In addition, according to the CrowdSec network, attack volume against CVE-2025-58360 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the GeoServer WMS GetMap operation by sending crafted XML payloads to endpoints like `/geoserver/wfs?service=WMS&request=GetMap` or `/wfs?service=WMS&request=GetMap`, leveraging XML External Entity (XXE) injection to disclose files or cause denial of service.

## Timeline

- 2025-11-25: CVE Published. CVE-2025-58360 is published to NVD.
- 2025-12-10: Rule Released. CrowdSec releases a rule to detect CVE-2025-58360 exploitation attempts against the CrowdSec Network.
- 2025-12-11: CISA KEV. CVE-2025-58360 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-12-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-58360 for the first time.
- 2026-01-01: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://osgeo-org.atlassian.net/browse/GEOS-11682
- https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58360.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-58360) follows observed exploitation activity for CVE-2025-58360. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.