CVE-2025-30220

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30220
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30220.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30220
Aliases
Related
Published
2025-06-10T15:16:39.339Z
Modified
2026-04-10T05:24:42.285549Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L CVSS Calculator
Summary
GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Details

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.

Database specific 
{
    "cwe_ids": [
        "CWE-611",
        "CWE-918"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30220.json"
}
References

Affected packages

Git
github.com/geonetwork/core-geonetwork

Affected ranges

Type
GIT
Repo
https://github.com/geonetwork/core-geonetwork
Events
Introduced
bdc0a9c92ef52718f7582bfa87149d1b93e02c0b
Fixed
42984e723d2c8e7b62e85915c730a617d5041ad1
Introduced
19b9edba4f9a5718047d3b17eb874c3ca769c26e
Fixed
d8dfca59671ac916b9860b2281104fc3c1323414
Database specific 
{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.13"
        },
        {
            "introduced": "4.4.0"
        },
        {
            "fixed": "4.4.8"
        }
    ]
}

Affected versions

4.*
4.2.0
4.2.1
4.2.10
4.2.11
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.2.9
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30220.json"
github.com/geoserver/geoserver

Affected ranges

Type
GIT
Repo
https://github.com/geoserver/geoserver
Events
Introduced
3802dca765d989eed828eecca55c3c469cb9ff05
Fixed
c7e6e87c478a56427c5720a3493497759c0f53df
Database specific 
{
    "versions": [
        {
            "introduced": "2.27.0"
        },
        {
            "fixed": "2.27.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/geoserver/geoserver
Events
Introduced
8f9b3e407de0b6a7d30fb9edf68ac6db0071b7bb
Fixed
4a7a6881894a879f097ca2f04d62733fcdaa2937
Database specific 
{
    "versions": [
        {
            "introduced": "2.26.0"
        },
        {
            "fixed": "2.26.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/geoserver/geoserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
035172d66d5225f758d789b0863bd46b2f7c15e8
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.25.7"
        }
    ]
}

Affected versions

2.*
2.11-beta
2.21-M0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30220.json"
github.com/geotools/geotools

Affected ranges

Type
GIT
Repo
https://github.com/geotools/geotools
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4f5e91f481b5779b63e3bcecb3bf25389bca0ca9
Introduced
76b6ac20cb7579da3a4c3f88b574e29aa1db80c2
Fixed
9c08b8cf8b3dec45981e1bf5283a8b14aa40046b
Introduced
1e7dfc3f76d52f53b7a7b0af9bc02d5a1c321535
Fixed
d72db7503b676cce7df7de21b7af4b679b8239d2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2f4be07eaece931a7f6f3cd2b903a95e4ef3a41f
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "28.6.1"
        },
        {
            "introduced": "29.0"
        },
        {
            "fixed": "31.7"
        },
        {
            "introduced": "32.0"
        },
        {
            "fixed": "32.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "33.0"
        }
    ]
}

Affected versions

21.*
21.6b
26.*
26.1a
26.1b
33.*
33.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30220.json"