CVE-2025-58360 — AI Deep Analysis Summary

🚨 **Essence**: GeoServer suffers from an **XML External Entity (XXE)** injection flaw.…

🛡️ **Root Cause**: **CWE-611** (Improper Restriction of XML External Entity Reference).…

📦 **Affected Versions**: - GeoServer **2.26.0** to **2.26.2** (exclusive of later patches) - GeoServer versions **before 2.25.6** 🔧 **Component**: The WMS (Web Map Service) module.

💀 **Attacker Capabilities**: - **Read Files**: Access arbitrary files on the server (High Confidentiality impact). - **DoS**: Crash the service or consume resources (Low Availability impact). - **Privileges**: No authen…

⚡ **Exploitation Threshold**: **LOW**. - **Network**: Remote (AV:N) - **Complexity**: Low (AC:L) - **Auth**: None required (PR:N) - **User Interaction**: None (UI:N) 🎯 Easy to exploit remotely without credentials.

🔓 **Public Exploits**: **YES**. Multiple PoCs are available on GitHub (e.g., ProjectDiscovery Nuclei templates, Blackash-CVE-2025-58360). Wild exploitation is likely imminent due to easy access.

🔍 **Self-Check**: - Use **Nuclei** with the CVE-2025-58360 template. - Scan for the `/geoserver/wms` endpoint. - Send crafted XML payloads to test for XXE responses. - Check version numbers against the affected list.

🩹 **Official Fix**: **YES**. The vendor has issued a security advisory (GHSA-fjf5-xgmq-5525).…

🚧 **No Patch Workaround**: - **WAF**: Block XML payloads containing external entity definitions (`<!…

🔥 **Urgency**: **HIGH**. - CVSS Score indicates **High Confidentiality** impact. - No auth required. - Public PoCs exist. 👉 **Action**: Patch immediately or apply WAF rules to prevent file disclosure.