CVE-2025-58360
Act now ● On CISA KEV — actively exploited
Actively exploited — on the CISA KEV list.
CVSS base
—
EPSS — probability of exploitation (30 days)
64.9%
99.2th percentile
CISA KEV
Listed
Added 2025-12-11 · patch by 2026-01-01
Weakness / dates
—
Published — · modified —
Description
OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.