org.geoserver.web:gs-web-app vulnerabilities
CVEs whose affected-version data names the org.geoserver.web:gs-web-app package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2024-45747High· 7.2GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
▾ Twilightgeoserver · org.geoserver:gs-mainvia GHSA
CVE-2025-52465High· 7.2GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
▾ Twilightgeoserver · org.geoserver.web:gs-web-appEPSS 0.62%via GHSA
CVE-2025-58175Medium· 6.5GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
▾ Sunlitgeoserver · org.geoserver.web:gs-web-appEPSS 0.47%via GHSA