CVE-2025-30220: GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 42.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-06-10 · updated 2026-06-17
Weakness: CWE-611

Description

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.

Affected products

geotools: before 28.6.1; from 29.0 before 31.7; from 32.0 before 32.3; 33.0 — fixed in 28.6.1, 31.7, 32.3
geonetwork core-geonetwork: from 4.2.0 before 4.2.13; from 4.4.0 before 4.4.8 — fixed in 4.2.13, 4.4.8
geoserver org.geoserver.extension:gs-db2: before 2.25.7; from 2.26.0 before 2.26.3; 2.27.0 — fixed in 2.25.7, 2.26.3

How to fix

Upgrade to a fixed version: geotools 28.6.1, 31.7, 32.3; geonetwork core-geonetwork 4.2.13, 4.4.8; geoserver org.geoserver.extension:gs-db2 2.25.7, 2.26.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-30220 or the next vulnerability affects your stack