CVE-2025-52465

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-52465", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-06-17T02:28:39.716Z", "datePublished": "2026-06-18T14:28:41.270Z", "dateUpdated": "2026-06-24T03:56:00.821Z"}, "containers": {"cna": {"title": "GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25"}, {"name": "https://github.com/geoserver/geoserver/pull/8584", "tags": ["x_refsource_MISC"], "url": "https://github.com/geoserver/geoserver/pull/8584"}, {"name": "https://osgeo-org.atlassian.net/browse/GEOS-11852", "tags": ["x_refsource_MISC"], "url": "https://osgeo-org.atlassian.net/browse/GEOS-11852"}, {"name": "https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild", "tags": ["x_refsource_MISC"], "url": "https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild"}], "affected": [{"vendor": "geoserver", "product": "org.geoserver.web:gs-web-app", "versions": [{"version": "< 2.26.4", "status": "affected"}, {"version": ">= 2.27.0, < 2.27.3", "status": "affected"}]}, {"vendor": "geoserver", "product": "org.geoserver.web:gs-web-sec-core", "versions": [{"version": "< 2.26.4", "status": "affected"}, {"version": ">= 2.27.0, < 2.27.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T14:28:41.270Z"}, "descriptions": [{"lang": "en", "value": "GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web interface is either disabled or completely removed are not affected since the vulnerability exists in one of the web pages."}], "source": {"advisory": "GHSA-7qmg-grcp-qf25", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-52465"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T03:56:00.821Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-52465", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-18T15:24:25.927170Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T15:24:28.449Z"}}], "cna": {"title": "GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page", "source": {"advisory": "GHSA-7qmg-grcp-qf25", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "geoserver", "product": "org.geoserver.web:gs-web-app", "versions": [{"status": "affected", "version": "< 2.26.4"}, {"status": "affected", "version": ">= 2.27.0, < 2.27.3"}]}, {"vendor": "geoserver", "product": "org.geoserver.web:gs-web-sec-core", "versions": [{"status": "affected", "version": "< 2.26.4"}, {"status": "affected", "version": ">= 2.27.0, < 2.27.3"}]}], "references": [{"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25", "name": "https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/geoserver/geoserver/pull/8584", "name": "https://github.com/geoserver/geoserver/pull/8584", "tags": ["x_refsource_MISC"]}, {"url": "https://osgeo-org.atlassian.net/browse/GEOS-11852", "name": "https://osgeo-org.atlassian.net/browse/GEOS-11852", "tags": ["x_refsource_MISC"]}, {"url": "https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild", "name": "https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web interface is either disabled or completely removed are not affected since the vulnerability exists in one of the web pages."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T14:28:41.270Z"}}}, "cveMetadata": {"cveId": "CVE-2025-52465", "state": "PUBLISHED", "dateUpdated": "2026-06-24T03:56:00.821Z", "dateReserved": "2025-06-17T02:28:39.716Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-18T14:28:41.270Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "org.geoserver.web:gs-web-app", "vendor": "geoserver", "versions": [{"status": "affected", "version": "< 2.26.4"}, {"status": "affected", "version": ">= 2.27.0, < 2.27.3"}]}, {"product": "org.geoserver.web:gs-web-sec-core", "vendor": "geoserver", "versions": [{"status": "affected", "version": "< 2.26.4"}, {"status": "affected", "version": ">= 2.27.0, < 2.27.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "003F5494-D544-4EF9-A951-96A2CBE0C458", "versionEndExcluding": "2.26.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E0712B8-BE54-43DF-9CCE-3A65824138C4", "versionEndExcluding": "2.27.3", "versionStartIncluding": "2.27.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web interface is either disabled or completely removed are not affected since the vulnerability exists in one of the web pages."}, {"lang": "es", "value": "GeoServer es un servidor de c\u00f3digo abierto que permite a los usuarios compartir y editar datos geoespaciales. Antes de las versiones 2.26.4 y 2.27.3, existe una vulnerabilidad que permite a un administrador autenticado con acceso al sistema de seguridad de GeoServer pasar nombres de archivo arbitrarios a la p\u00e1gina web Master Password Dump y crear archivos que contengan la contrase\u00f1a maestra en texto plano. El nombre de archivo proporcionado debe ser una ruta absoluta al archivo de destino, el archivo de destino no puede existir previamente y todos los directorios padre deben existir previamente. Las versiones 2.26.4 y 2.27.3 contienen una correcci\u00f3n. Las instalaciones de GeoServer donde la interfaz web est\u00e1 deshabilitada o completamente eliminada no se ven afectadas ya que la vulnerabilidad existe en una de las p\u00e1ginas web."}], "id": "CVE-2025-52465", "lastModified": "2026-10-06T22:10:00.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-52465", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-18T16:16:52.027", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/geoserver/geoserver/pull/8584"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-7qmg-grcp-qf25"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://osgeo-org.atlassian.net/browse/GEOS-11852"}, {"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.26.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.27.0,2.27.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "org.geoserver.web:gs-web-app", "source": "cna", "vendor": "geoserver"}, "product": "geoserver", "vendor": "geoserver"}], "created": "2026-06-18T17:45:13.104616+00:00", "updated": "2026-06-20T22:56:01.256224+00:00", "vendors": ["geoserver", "geoserver$PRODUCT$geoserver"]}