CVE-2025-30220

The GeoTools library uses the Eclipse XSD class to represent XML schema structures. When a processed XML document contains a reference to an external XML schema, the Schemas class does not use the EntityResolver object provided by ParserHandler. As a result, external XML entities can be resolved without restrictions, allowing an attacker to inject a specially crafted XML document pointing to local server resources or internal network addresses. This also applies to gt-wfs-ng DataStore users, where the ENTITY_RESOLVER connection parameter was not applied as intended.

An attacker can read arbitrary files from the server file system (e.g., passwords, configuration keys) and conduct SSRF attacks by sending requests to internal network resources inaccessible directly from the Internet. The vulnerability has a scope extending beyond the attacked application (Scope: Changed), which significantly increases its criticality.

The software should be updated as soon as possible to versions with the vulnerability removed: GeoTools 33.1, 32.3, 31.7 or 28.6.1; GeoServer 2.27.1, 2.26.3 or 2.25.7; GeoNetwork 4.4.8 or 4.2.13. As a temporary workaround, it is recommended to disable the processing of external XML entities in accordance with the manufacturer's guidelines available at: https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities

GeoTools in versions prior to 33.1, 32.3, 31.7 and 28.6.1; GeoServer in versions prior to 2.27.1, 2.26.3 and 2.25.7; GeoNetwork in versions prior to 4.4.8 and 4.2.13. The vulnerability affects any system that processes XML documents with references to external schemas using the gt-xsd-core module.