geoserver has 4 CVEs on record. 1 was published in the last 90 days. The busiest recent month was June 2026 with 3. The median CVSS is 7.2 (high). Most affected products: org.geoserver.web:gs-web-app (2), org.geoserver.extension:gs-db2 (1), org.geoserver:gs-main (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 1 prev 3
Products
- org.geoserver.web:gs-web-app 2
- org.geoserver.extension:gs-db2 1
- org.geoserver:gs-main 1
Worst active — by depth score
CVE-2024-45747High· 7.2GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates40CVE-2025-52465High· 7.2GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page40CVE-2025-27511High· 7.2GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection40CVE-2025-58175Medium· 6.5GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution36
geoserver vulnerabilities
CVEs affecting geoserver, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2024-45747High· 7.2GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
CVE-2025-52465High· 7.2GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
CVE-2025-58175Medium· 6.5GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
CVE-2025-27511High· 7.2GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection