CVE-2025-27511

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.2 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

Vulnerability Details

Published Date

June 11, 2026

Last Modified

June 24, 2026

CWE ID

CWE-74

Source

GitHub

Vendor

maven

Product

org.geoserver.extension:gs-db2

External References

https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7
https://github.com/geoserver/geoserver/releases/tag/2.27.0
https://github.com/advisories/GHSA-g628-r368-6vh7

CVE-2025-27511

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment