CVE-2025-52465 json
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
published 2026-06-12 4 mo ago modified 2026-10-06 33 d ago also GHSA-7qmg-grcp-qf25 , EUVD-2025-210277
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web interface is either disabled or completely removed are not affected since the vulnerability exists in one of the web pages.
Patch / fix
- maven org.geoserver.web:gs-web-app 2.26.4, 2.27.3
- maven org.geoserver.web:gs-web-sec-core 2.26.4, 2.27.3
- osgeo geoserver 2.26.4, 2.27.3
- github.com/geoserver/geoserver#8584 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.geoserver.web:gs-web-app | >=2.27.0, <2.27.3 <2.26.4 |
2.27.3 2.26.4 |
| maven | org.geoserver.web:gs-web-sec-core | >=2.27.0, <2.27.3 <2.26.4 |
2.27.3 2.26.4 |
Affected products
- geoserver org.geoserver.web:gs-web-app
- geoserver org.geoserver.web:gs-web-sec-core
Classification
- Weakness
-
- CWE-73 External Control of File Name or Path
References
-
github.com
/geoserver/geoserver/pull/8584
web, issue-tracking, patch
-
github.com
/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25
web, mitigation, vendor-advisory
-
osgeo-org.atlassian.net
/browse/GEOS-11852
web, issue-tracking
-
research.checkpoint.com
/2025/cve-2025-24054-ntlm-exploit-in-the-wild
web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2025-52465
advisory
-
github.com
/geoserver/geoserver
package
Sources
- CVE List CVE-2025-52465
- GitHub Advisory GHSA-7qmg-grcp-qf25
- NVD CVE-2025-52465
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.