CVE-2025-21621

MEDIUM

Geoserver < 2.25.0 - XSS

Title source: rule
STIX 2.1

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting (XSS) vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's browser through specially crafted SLD_BODY parameters. This issue has been patched in version 2.25.0.

Scores

CVSS v3 6.1
EPSS 0.0003
EPSS Percentile 7.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (3)
geoserver/geoserver < 2.25.0
org.geoserver/gs-wms 0 - 2.25.0Maven
org.geoserver.web/gs-web-app 0 - 2.25.0Maven
Published Nov 25, 2025
Tracked Since Feb 18, 2026