CVE - CVE-2025-30220

CVE-ID
CVE-2025-30220	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities URL:https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities MISC:https://github.com/geonetwork/core-geonetwork/pull/8757 URL:https://github.com/geonetwork/core-geonetwork/pull/8757 MISC:https://github.com/geonetwork/core-geonetwork/pull/8803 URL:https://github.com/geonetwork/core-geonetwork/pull/8803 MISC:https://github.com/geonetwork/core-geonetwork/pull/8812 URL:https://github.com/geonetwork/core-geonetwork/pull/8812 MISC:https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc URL:https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc MISC:https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc URL:https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc MISC:https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw URL:https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20250318	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250318)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)