Review reviewHigh

CVE-2025-52465

geoserver org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core, geoserver

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web in...

CVSS: 7.2
EPSS: 0.62%
CISA KEV: Not listed
Published: 2026.06.19

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.62%

Technical severityCVSS 7.2

Vulnerability overview

Affected product and versions

Product: geoserver org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core, geoserver
Affected versions: < 2.26.4, >= 2.27.0, < 2.27.3, >= 2.27.0 < 2.27.3
Fixed versions: 2.26.4, 2.27.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that geoserver org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core, geoserver and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-73