{"action":"Upgrade org.geoserver:gs-wfs to 2.25.7 (2.25.x), 2.26.3 (2.26.x) or 2.27.1 (2.27.x) or later.","affected":[{"fixed":"2.27.1","introduced":"2.27.0"},{"fixed":"2.26.3","introduced":"2.26.0"},{"fixed":"2.25.7","introduced":"0"}],"component":"org.geoserver:gs-wfs","cve_ids":["CVE-2025-30220"],"ecosystem":"Maven","epss":0.42285,"exploited":false,"fixed_versions":["2.27.1","2.26.3","2.25.7"],"ghsa_id":"GHSA-jj54-8f66-c5pc","id":"tcs_01M5N932724QHAZXHVPN8JSGQM","modified_at":"2026-02-04T03:19:48.250474Z","published_at":"2025-06-10T20:10:06Z","references":["https://osv.dev/vulnerability/GHSA-jj54-8f66-c5pc","https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc","https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc","https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw","https://nvd.nist.gov/vuln/detail/CVE-2025-30220","https://github.com/geonetwork/core-geonetwork/pull/8757","https://github.com/geonetwork/core-geonetwork/pull/8803","https://github.com/geonetwork/core-geonetwork/pull/8812","https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities","https://github.com/geoserver/geoserver"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-jj54-8f66-c5pc#Maven/org.geoserver:gs-wfs","url":"https://osv.dev/vulnerability/GHSA-jj54-8f66-c5pc"}],"summary":"[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service"}