CVE-2025-58360 CISA KEV · Actively exploited
XML external entity injection in Geoserver
CVSS score
9.8
EPSS probability
%60.5
Risk score
11.9
Published
10 mo ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals. The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31. GeoNetwork originated at the United Nations Food and
Similar Vulnerabilities
7.2
CVE-2025-27511Deserialization of untrusted data in Osgeo Geoserver
Patch status unknownEPSS %1
7.2
8.2
CVE-2025-58175Improper input validation in Osgeo Geoserver
Patch verifiedEPSS %0
6.1
CVE-2025-21621Cross-site scripting in Geoserver
Patch verifiedEPSS %0
5.5
CVE-2026-8213Memory buffer overflow in Osgeo Gdal
Patch verified Public Exploits:2EPSS %0
5.5
CVE-2026-8212Memory buffer overflow in Osgeo Gdal
Patch verified Public Exploits:2EPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-58360"