A critical XML External Entity (XXE) vulnerability in OSGeo GeoServer is being actively exploited in the wild, posing a severe risk of information disclosure and service disruption.

This is an XML External Entity (XXE) injection flaw occurring within the /geoserver/wms GetMap endpoint. The vulnerability allows unauthenticated remote attackers to submit malicious XML input that is not sufficiently sanitized, enabling them to define external entities to read local files or perform server-side request forgery.

The CVSS score of 9.5 classifies this as a critical vulnerability. Successful exploitation grants attackers the ability to access sensitive system files or internal network resources, potentially leading to total system compromise or significant data theft. Given the active exploitation observed in the wild, the risk to organizational infrastructure is extreme, necessitating immediate remediation to prevent unauthorized access and potential data exfiltration.

Immediate Action: Upgrade to GeoServer version 2.25.6, 2.26.3, or 2.27.0 immediately to apply the necessary security patches.

Proactive Monitoring: Inspect server logs for suspicious requests directed at the /geoserver/wms endpoint, specifically looking for XML payloads containing entity definitions or unexpected outbound connection attempts from the server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block XML inputs containing DOCTYPE declarations or external entity references as a temporary protective measure.

Public Exploit Available: Yes, a weaponized exploit exists, including a Metasploit module and Nuclei detection templates.

The presence of this vulnerability in the CISA Known Exploited Vulnerabilities catalog combined with the availability of weaponized exploit code makes this a top-tier priority. Organizations must bypass standard change management cycles to verify their GeoServer instances and apply the provided patches immediately. Failure to address this flaw leaves the environment exposed to active, high-impact exploitation attempts.