CVE-2025-30220

GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.19.9Critical EPSS percentile99th42% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2025-06-10Updated 2025-08-26Sources: CVE.org, NVD, GitHub, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Identify whether you run affected software and note the exact installed versions of GeoServer, GeoTools (if embedded in your app), and GeoNetwork.
If you have GeoServer (or modules named gs-web-app / gs-wfs), upgrade them to at least version 2.27.1.
If you have GeoServer older branches, upgrade to the fixed versions matching your line: GeoServer 2.25.7 or 2.26.3 (depending on what you’re running and what your upgrade path allows).
If you use GeoTools, upgrade it to at least version 28.6.1.
If you run GeoNetwork, upgrade it to at least version 4.2.13.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.

In plain language

Written by AI from the record

GeoServer, GeoTools, and GeoNetwork can be tricked into reading “external” XML schema files, which may let an attacker steal information without logging in—most small businesses using these products should treat this as urgent and upgrade.

Unauthenticated XXE (CWE-611/CWE-918) in GeoTools/GeoServer/GeoNetwork XML schema handling allows attackers to supply crafted XML that references external schemas; the products may resolve and process those external entities during parsing (via gt-xsd-core/XSD handling), leading to sensitive data disclosure.

If you're affected

Sensitive system data disclosure
Leaked configuration or documents
Potential service disruption
Breach risk from internet scanning

What is it

This flaw is like a “file-reader trap” inside the software’s XML checker. If someone sends the server a specially crafted XML message, the server can be tricked into following a pointer to an external XML schema and reading content it shouldn’t. In real terms, that can expose internal information from the system processing that XML.

Who is affected

This matters if your business runs or depends on GeoServer, GeoTools, or GeoNetwork—especially if your setup processes XML with external schema/XSD references. The findings indicate the attack does not require a login and needs no user click, so internet scanning or crafted requests can reach the vulnerable parsing path. Act quickly if your GeoServer/GeoNetwork endpoints are reachable from the network where attackers can send XML inputs (and the XML/XSD schema processing path is in use).

How urgent is it

VERDICT: RED. Attackers can send crafted XML over the network without logging in, and the weakness is in core XML schema (XSD) handling—this is exactly the kind of issue that gets automated probing. If you use GeoServer/GeoNetwork/GeoTools in a way that processes external XML schemas, you should upgrade now rather than wait.

What to do — in detail

Confirm exposure

Check what you run:
- GeoServer version (and confirm which modules are used, especially WFS-related parts such as gs-wfs and web app parts such as gs-web-app).
- GeoNetwork version (if you run it).
- GeoTools version (if it’s embedded in your application or dependency).
If you can, also confirm whether your environment accepts XML inputs that involve XSD/schema parsing or external schema references. The core condition from the findings is: XML processing is enabled with gt-xsd-core involved, and documents reference an external XML schema.

Upgrade to fixed versions

Upgrade to the fixed versions below (use the fixed version(s) that match the component/version you actually run):

GeoServer:
- Fixed in 2.27.1
- Also fixed in 2.26.3
- Also fixed in 2.25.7
gs-web-app / gs-wfs (GeoServer components): fixed in 2.27.1
GeoTools: fixed in 28.6.1
GeoNetwork: fixed in 4.2.13

Practical upgrade path / breaking-change note

Follow your vendor/project’s standard upgrade instructions for the branch you’re on, moving to the corresponding fixed version (for example, if you are on an older 2.x GeoServer line, upgrade to the fixed version for that line—2.25.7 or 2.26.3—rather than jumping blindly if it would be disruptive).
After upgrade, run a quick smoke test focused on the features that parse or load schemas/XSDs (e.g., any import/config or service endpoints that accept or validate XML).

If you cannot upgrade immediately (temporary containment)

Restrict network access so that only trusted systems can reach the GeoServer/GeoNetwork endpoints that process XML.
Block/limit requests from untrusted networks at the firewall/reverse proxy layer until the fixed version is deployed.

What to monitor after patching

Web server/proxy logs for repeated requests containing XML or schema/XSD references.
Application logs for XML parsing/schema validation errors (spikes can indicate probing attempts).

KEV / due date

No KEV entry was listed for this CVE in the provided findings.

Technical context

CVE-2025-30220 is an XXE issue (CWE-611: Improper Restriction of XML External Entity Reference; CWE-918: Server-Side Request Forgery (SSRF) through XML External Entities) affecting GeoTools, GeoServer, and GeoNetwork when they process XML schema/XSD inputs in a way that allows external schema references. The findings state exploitation is possible over the network without authentication or user interaction, where XML processing is enabled with gt-xsd-core parsing and attacker-controlled XML references an external XML schema. The backstop notes gt-xsd-core Schemas may not properly use a configured EntityResolver, which is meant to control how external entities are resolved; similarly, a gt-wfs-ng DataStore parameter intended to set ENTITY_RESOLVER may not be used as intended. A public proof-of-concept exists (1 known). No CISA KEV listing was provided. The provided patch guidance identifies fixed versions: GeoTools 28.6.1, GeoServer 2.25.7 / 2.26.3 / 2.27.1, and GeoNetwork 4.2.13. The traffic-light verdict for this CVE is RED.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

42% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 192 days before any public exploit.

2026-08-31EPSS band changehigh → moderateepss band change
2026-07-06EPSS band changemoderate → high
2026-06-30EPSS band changemoderate → high
2026-06-25OpenVAS check added
2026-04-06EPSS band changelow → moderate
2026-03-07Public exploit / PoCsource: github-poc

Affected products

Mavenpackage-ecosystem
- org.geoserver.web:gs-web-appOSS Libraries
- org.geoserver:gs-wfsOSS Libraries
Open Source Geospatial Foundation (OSGeo)oss-projectaka osgeo
- GeoToolsOn-premOSS Libraries / generic-library
- GeoServerOn-premOSS Libraries / generic-library
osgeooss-projectaka gdal, geoserver, mapserver
- geonetworkMixedOSS Libraries / generic-library
- geoserverMixedOSS Libraries / generic-library
geoserveross-projectaka geowebcache
- geoserverOn-premWeb & CMS Plugins / cms-core
geotoolsoss-project
- geotoolsLibraryOSS Libraries / generic-library

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Scored 9.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service