Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.geoserver.web/gs-web-app@2.26.2
purl pkg:maven/org.geoserver.web/gs-web-app@2.26.2
Next non-vulnerable version 2.26.4
Latest non-vulnerable version 2.27.3
Risk score 3.7
Vulnerabilities affecting this package (2)
Advisory Summary Fixed in package version
GHSA-jj54-8f66-c5pc
Aliases:
CVE-2025-30220
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service ## Summary GeoServer Web Feature Service (WFS) web service …
2.26.3
Vulnerable
2.26.3
Vulnerable
GHSA-gr67-pwcv-76gf
Aliases:
CVE-2025-30145
GeoServer Infinite Loop Vulnerability in Jiffle process ### Summary Malicious Jiffle scripts can be executed by GeoServer, either as a …
2.26.3
Vulnerable
2.26.3
Vulnerable
Vulnerabilities fixed by this package (4)

Advisory Summary Aliases
GHSA-fjf5-xgmq-5525
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature ## Description An XML External Entity … CVE-2025-58360
GHSA-jm79-7xhw-6f6f
GWC Home Page communicate version and revision information ### Summary The GeoWebCache home page includes version and revision information about … CVE-2024-38524
CVE-2024-38524
GWC Home Page communicate version and revision information The GeoWebCache home page includes version and revision information about the software … GHSA-jm79-7xhw-6f6f
CVE-2025-58360
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature An XML External Entity (XXE) vulnerability … GHSA-fjf5-xgmq-5525