CVE-2025-21621 GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format
Remote attackers can execute arbitrary JavaScript in victims' browsers via crafted SLD_BODY parameters in GeoServer's WMS GetFeatureInfo HTML output.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-21621?
CVE-2025-21621 is a medium-severity cross-site scripting vulnerability in geoserver, published on 25 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting (XSS) vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's browser through specially crafted SLD_BODY parameters. This issue has been patched in version 2.25.0.
Weakness: CWE-79
Which versions are affected by CVE-2025-21621?
4 open source packages ship an affected version, including org.geoserver.web:gs-web-app and org.geoserver:gs-wms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.geoserver.web:gs-web-app Maven | All versions | 2.25.0 |
org.geoserver.web:gs-web-app Maven | All versions | 2.25.0 |
org.geoserver:gs-wms Maven | All versions | 2.25.0 |
org.geoserver:gs-wms Maven | All versions | 2.25.0 |
Products include Geoserver Geoserver.
How do I fix CVE-2025-21621?
Upgrade org.geoserver.web:gs-web-app to 2.25.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-21621 being exploited?
There is no known exploitation of CVE-2025-21621 in the wild and no public exploit code.
Other vulnerabilities in geoserver
- CVE-2024-36401 OSGeo GeoServer GeoTools Eval Injection
- CVE-2025-58360 OSGeo GeoServer Improper Restriction of XML External Entity Reference
- CVE-2023-35042 GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language
- CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat
- CVE-2023-41877 GeoServer log file path traversal vulnerability
Sources
Also known as GHSA-w66h-j855-qr72.