CVE-2025-52465

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-52465
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52465.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-52465
Aliases
Published
2026-06-18T14:28:41.270Z
Modified
2026-07-08T07:16:25.728794535Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
Details

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web interface is either disabled or completely removed are not affected since the vulnerability exists in one of the web pages.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52465.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-73"
    ]
}
References

Affected packages

Git / github.com/geoserver/geoserver

Affected ranges

Type
GIT
Repo
https://github.com/geoserver/geoserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d5a3aed4d0852e4f5e5e291736b400d34569af8d
Introduced
3802dca765d989eed828eecca55c3c469cb9ff05
Fixed
46ecb5474861803109769958c8d89f090ce96944
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.26.4"
        },
        {
            "introduced": "2.27.0"
        },
        {
            "fixed": "2.27.3"
        }
    ]
}

Affected versions

2.*
2.11-beta
2.21-M0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52465.json"