cveboard RSS feed

CVE-2025-52465

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web interface is either disabled or completely removed are not affected since the vulnerability exists in one of the web pages.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

org.geoserver.web:gs-web-app

Vendor
geoserver
Product
org.geoserver.web:gs-web-app
Platforms
Unknown
Default status
Unknown
org.geoserver.web:gs-web-app · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
< 2.26.4affectedUnavailableUnavailableUnavailableNone listed
>= 2.27.0, < 2.27.3affectedUnavailableUnavailableUnavailableNone listed

org.geoserver.web:gs-web-sec-core

Vendor
geoserver
Product
org.geoserver.web:gs-web-sec-core
Platforms
Unknown
Default status
Unknown
org.geoserver.web:gs-web-sec-core · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
< 2.26.4affectedUnavailableUnavailableUnavailableNone listed
>= 2.27.0, < 2.27.3affectedUnavailableUnavailableUnavailableNone listed