CVE-2025-27511

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27511
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27511.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-27511
Aliases
Published
2026-06-18T14:23:01.788Z
Modified
2026-08-12T03:51:12.908650393Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
Details

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-502",
        "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27511.json"
}
References

Affected packages

Git / github.com/geoserver/geoserver

Affected ranges

Type
GIT
Repo
https://github.com/geoserver/geoserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3802dca765d989eed828eecca55c3c469cb9ff05
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.27.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*"
}

Affected versions

2.*
2.11-beta
2.21-M0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27511.json"