{"uuid": "a664b6bb-fe0a-496e-a85a-80a926241441", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58360", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"xbow-security\", \"Valentin Lobstein \", \"Julien Voisin\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits an XML External Entity (XXE) vulnerability in GeoServer\\n          via the WMS GetMap operation. The vulnerability allows reading arbitrary files\\n          from the server's file system by injecting an XXE entity in the SLD (Styled Layer Descriptor).\\n\\n          Affected versions:\\n          - GeoServer >= 2.26.0, <= 2.26.1\\n          - GeoServer <= 2.25.5\\n\\n          The file content is returned in the error message when the layer name contains\\n          the XXE entity reference.\", \"disclosure_date\": \"2025-11-25\", \"fullname\": \"auxiliary/gather/geoserver_wms_getmap_xxe_file_read\", \"is_install_path\": true, \"mod_time\": \"2025-12-13 17:42:02 +0000\", \"name\": \"GeoServer WMS GetMap XXE Arbitrary File Read\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"gather/geoserver_wms_getmap_xxe_file_read\", \"references\": [\"CVE-2025-58360\", \"URL-https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:14.651959Z"}