CVE-2025-27511
published 2026-06-18CVE-2025-27511: GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an…
PriorityP350high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.58%
43.4th percentile
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| geoserver | org.geoserver.extension_gs-db2 | < 2.27.0 | 2.27.0 |
| osgeo | geoserver | < 2.27.0 | 2.27.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
geoserver org..extension:gs-db2 up to 2.26.x deserialization (GHSA-g628-r368-6vh7)
vuldb·2026-06-18
CVE-2025-27511 [LOW] geoserver org..extension:gs-db2 up to 2.26.x deserialization (GHSA-g628-r368-6vh7)
A vulnerability identified as problematic has been detected in geoserver org..extension:gs-db2 up to 2.26.x. This impacts an unknown function. The manipulation leads to deserialization.
This vulnerability is uniquely identified as CVE-2025-27511. The attack is possible to be carried out remotely. No exploit exists.
You should upgrade the affected component.
GHSA
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
ghsa·2026-06-11
CVE-2025-27511 [HIGH] CWE-502 GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
## Summary
Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution (RCE).
## Impact
If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code.
## Details
Authenticated users can access Vector Data Sources page to creating a new data store through db2 jdbc connection, performing JNDI attack due to unrestricted connection parameters, and then achieve RCE with deserialization of untrusted data.
### Remediation
This issue has been fixed in this release: https://github.com/geoserver/geoserver/releases/tag/2.27.0.
## References
* https://osgeo-org.atlassian.net/browse/GEOT-7725
* https://nvd.nist.gov/vuln/detail/cv
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-18
Published