GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
## Summary Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution (RCE). ## Impact If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code. ## Details Authenticated users can access Vector Data Sources page to creating a new data store through db2 jdbc connection, performing JNDI attack due to unrestricted connection parameters, and then achieve RCE with deserialization of untrusted data. ### Remediation This issue has been fixed in this release: https://github.com/geoserver/geoserver/releases/tag/2.27.0. ## References * https://osgeo-org.atlassian.net/browse/GEOT-7725 * https://nvd.nist.gov/vuln/detail/cve-2023-27867
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-27511US | — | — | ||
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perfo… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/geoserver/geoserverPACKAGE
- https://github.com/geoserver/geoserver/releases/tag/2.27.0WEB
- https://github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-27511ADVISORY
- https://nvd.nist.gov/vuln/detail/cve-2023-27867ADVISORY
- https://osgeo-org.atlassian.net/browse/GEOT-7725WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan