VulnerabilityAnalyzed

CVE-2025-27511

GeoServer is an open source server that allows users to share and edit geospatial data.

HIGH 7.2EPSS 1.07%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.07%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.07% probability · 63th percentile
CISA KEV: Not listed
Weakness: CWE-74, CWE-502
Affected: osgeo/geoserver
Source: security-advisories@github.com

References

https://github.com/geoserver/geoserver/releases/tag/2.27.0Product, Release Notes
https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7Vendor Advisory
https://nvd.nist.gov/vuln/detail/cve-2023-27867Not Applicable
https://osgeo-org.atlassian.net/browse/GEOT-7725Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.