CVE-2025-30220: 
Java vulnerability analysis and mitigation

GeoTools Schema class use of Eclipse XSD library to represent schema data structure was discovered to be vulnerable to XML External Entity (XXE) exploitation (CVE-2025-30220). The vulnerability was disclosed on June 10, 2025, affecting GeoServer versions prior to 2.27.1, 2.26.3, and 2.25.7, GeoTools versions prior to 33.1, 32.3, 31.7, and 28.6.1, and GeoNetwork versions 4.4.0 through 4.4.7 and 4.2.0 through 4.2.12 (GeoTools Advisory, GeoServer Advisory).

The vulnerability stems from the gt-xsd-core Schemas class not utilizing the EntityResolver provided by the ParserHandler. While direct entity resolution is managed by application property ENTITYRESOLUTIONALLOWLIST for XML Parsing, this restriction was not being used by the GeoTools library when building an in-memory XSD Library Schema representation, bypassing GeoServer's AllowListEntityResolver. The vulnerability has been assigned a CVSS v3.1 score of 9.9 (Critical) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L (GeoTools Advisory).

The vulnerability allows unauthenticated attackers to perform XML External Entity (XXE) processing attacks, enabling Out-of-Band (OOB) data exfiltration of local files accessible by the GeoServer process and Service Side Request Forgery (SSRF). This can lead to exposure of sensitive information including configuration files, credentials, and system files. The attack can be performed remotely without authentication, making it particularly severe (GeoServer Advisory).

The vulnerability has been fixed in GeoTools versions 33.1, 32.3, 31.7, and 28.6.1, corresponding to GeoServer versions 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork versions 4.4.8 and 4.2.13. For systems that cannot immediately update, administrators can configure external entity resolution restrictions using the ENTITYRESOLUTIONALLOWLIST property. For GeoNetwork users, a workaround is available by removing the gn-wfsfeature-harvester and gn-camelPeriodicProducer jars, which will disable the WFS Index functionality (GeoTools Advisory, GeoServer Advisory).