OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

OSGeo GeoServer

OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request. Added to CISA KEV on 2025-12-11 (federal deadline 2026-01-01).

First seen: 11 Dec 2025
Last update: 11 Dec 2025, 12:00 UTC
Identifiers: CVE-2025-58360
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: OSGeo GeoServer
Ids: CVE-2025-58360

OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request. Added to CISA KEV on 2025-12-11 (federal deadline 2026-01-01).

## Steps
1. Search the repo, its CI and infra config for OSGeo GeoServer. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-58360") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2025-58360 https://osgeo-org.atlassian.net/browse/GEOS-11922
https://pwned.coffee/i/osgeo-geoserver-improper-restriction-of-xml-external-ent-cve-2025-58360

Sources

Totalone hot coffee