Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-27511: GeoServer DB2 extension permits remote code execution

CVE-2025-27511 · published 4 months ago

Summary

The GeoServer DB2 DataStore Extension before version 2.27.0 lets an administrator craft a special DB2 connection string that can run code on the server. This could let an attacker take control of the system. Upgrade to GeoServer 2.27.0 or later to close the risk.

What to do

Update geoserver org.geoserver.extension:gs-db2 to version 2.27.0.
Update osgeo geoserver to version 2.27.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	geoserver	org.geoserver.extension:gs-db2	< 2.27.0 Fix: upgrade to 2.27.0
–	osgeo	geoserver	< 2.27.0 `cpe:2.3:a:osgeo:geoserver::::::::`

Original advisory text

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

References

https://github.com/advisories/GHSA-g628-r368-6vh7
https://github.com/geoserver/geoserver/releases/tag/2.27.0 URL
https://osgeo-org.atlassian.net/browse/GEOT-7725 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27511... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-27511 Vendor Advisory
https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7 Vendor Advisory
https://nvd.nist.gov/vuln/detail/cve-2023-27867 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.2 High

Exploitation

1% chance of attack within 30 days

Type

CWE-74Injection

CWE-502Deserialization of Untrusted Data

Timeline

Published18 Jun 2026

Updated4 Nov 2026

First seen11 Jun 2026

Sources

GHSA-g628-r368-6vh7 · GHSA

CVE-2025-27511 · NVD

CVE-2025-27511 · OSV

Track software like this

Free during beta