Arbitrary File Creation Vulnerability in GeoServer
CVE-2025-52465
What is CVE-2025-52465?
GeoServer is an open-source platform that facilitates the sharing and editing of geospatial data. A vulnerability allows an authenticated administrator to supply arbitrary file names to a web page designed to handle Master Password Dumps, potentially leading to the creation of files that expose the master password in plaintext. This issue arises from the requirement that the specified file name be an absolute path to the desired target file, which must not already exist while all parent directories must be present. Implementations where the web interface is either disabled or removed are not subject to this issue. Versions 2.26.4 and 2.27.3 have addressed this vulnerability through patching.
Affected Version(s)
org.geoserver.web:gs-web-app < 2.26.4 < 2.26.4
org.geoserver.web:gs-web-app >= 2.27.0, < 2.27.3 < 2.27.0, 2.27.3
org.geoserver.web:gs-web-sec-core < 2.26.4 < 2.26.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.