By vendor

Osgeo vulnerabilities

Known CVEs affecting Osgeo products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2025-27511HIGH 7.2

  GeoServer, a widely-used open-source geospatial data platform, contains a vulnerability in its DB2 DataStore Extension that allows authenticated administrators to execute arbitrary code on the server through a malicious database connection string. An attacker with admin credentials can craft a specially crafted DB2 JDBC URL that exploits JNDI (Java Naming and Directory Interface) injection to achieve remote code execution. The vulnerability was patched in version 2.27.0.

• CVE-2025-52465HIGH 7.2

  GeoServer, an open-source geospatial data server, contains a vulnerability that allows authenticated administrators to write the master password to arbitrary files on the server. An attacker with admin credentials can navigate to the Master Password Dump page and specify an absolute file path to dump the plaintext master password, potentially exposing it to unauthorized access or further compromise. This requires the attacker already have administrative access and the target file path must not exist, but the vulnerability significantly reduces the security of GeoServer's most sensitive credential.

• CVE-2025-58175MEDIUM 6.5

  GeoServer, an open-source geospatial data sharing platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions before 2.26.4 and 2.27.3. An attacker without authentication can exploit this flaw to make the server perform unauthorized network requests on their behalf, potentially accessing internal resources or sensitive data. The vulnerability is only active when GeoServer is configured with a proxy base URL lacking a path component or trailing slash, and when entity resolution allowlist is enabled (the default since version 2.25.0).