CVE-2025-27511CWE-502CWE-74insecure-deserialization

CVE-2025-27511

High · published June 18, 2026

CVSS v3.1

7.2

EPSS

Percentile

64.7

In the wild

Unconfirmed

What it is

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.01074 · 64.7th percentile
Weaknesses: CWE-502 · Deserialization of Untrusted Data; CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published: 2026-06-18T20:16Z

Affected products (1)

Product	Versions	Fixed in
osgeo/geoserver	< 2.27.0	2.27.0

References (4)

https://github.com/geoserver/geoserver/releases/tag/2.27.0 · [email protected]https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7 · [email protected]https://nvd.nist.gov/vuln/detail/cve-2023-27867 · [email protected]https://osgeo-org.atlassian.net/browse/GEOT-7725 · [email protected]

EPSS history

Timeline

18 JUN 14:23Z
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
cvelistv5