CVE-2025-58360

This PoC demonstrates an XXE vulnerability in GeoServer versions 2.26.0 to 2.26.2 and before 2.25.6. It sends a crafted XML payload to the /geoserver/wms endpoint to read /etc/passwd.

This repository contains a Python-based exploit for CVE-2025-58360, an XXE vulnerability in GeoServer. The exploit automates the process of leaking arbitrary files from a vulnerable GeoServer instance by crafting malicious XML payloads and extracting the leaked data from the server's response.

This repository describes a bypass technique for CVE-2025-58360, an unauthenticated XXE vulnerability in GeoServer. The attack leverages the WMS GetMap operation via the OWS endpoint to bypass WAF protections.

This is a functional PoC for CVE-2025-58360, demonstrating an unauthenticated XXE vulnerability in GeoServer's WMS GetMap endpoint via the SLD_BODY parameter. The exploit includes educational explanations and supports file reading and SSRF probing.

This repository provides a Nuclei template for detecting CVE-2025-58360, an unauthenticated XXE vulnerability in GeoServer versions prior to 2.25.6, 2.26.2, 2.27.0, 2.28.0, and 2.28.1. The script checks headers for the last updated date to identify vulnerable instances.

This repository contains a detailed writeup and proof-of-concept examples for CVE-2025-58360, an XXE vulnerability in GeoServer's WMS endpoint. It includes technical details, affected versions, and exploit examples for file disclosure, SSRF, and DoS attacks.

This Metasploit module exploits an XXE vulnerability in GeoServer via the WMS GetMap operation to read arbitrary files from the server's filesystem. The exploit crafts a malicious SLD payload with an external entity reference and extracts the file content from the error response.