{"items":[{"id":"NVI-00015307","kind":"vulnerability","title":"GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wf6j-gr27-g7ch","CVE-2024-45747"],"plain_summary":"GitHub lists this reviewed advisory for org.geoserver:gs-main, org.geoserver:gs-wms, org.geoserver.web:gs-web-app. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5936c572845174f5cc1e5579fd3b318d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-19T19:31:57.000Z","value":"7.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5936c572845174f5cc1e5579fd3b318d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5936c572845174f5cc1e5579fd3b318d","url":"https://github.com/advisories/GHSA-wf6j-gr27-g7ch","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wf6j-gr27-g7ch","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:14:33.912Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5936c572845174f5cc1e5579fd3b318d"],"technology":"org.geoserver:gs-main","known_exclusions":[],"conditions_summary":"### Summary\nA server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a plain GeoServer instance (no extension or community modules) for WMS GetFeatureInfo HTML and JSON and WMS GetMap KML and GeoRSS output formats.\n\n### Details\nThe org.geoserver.template.TemplateUtils.getSafeConfiguration() method attempts to block access to the class freemarker.template.utility.Execute but it is still possible to gain access to it and other sensitive functionality by chaining a specific sequence of method calls.\n\n### Impact\nThis vulnerability can lead to executing arbitrary code and reading and writing arbitrary files.\n\n### Resolution\nGeoServer 2.27.0 addresses this vulnerability with several new application properties:\n\n* ``GEOSERVER_FREEMARKER_BLOCK_LIST``\n* ``GEOSERVER_FREEMARKER_ALLOW_LIST``\n* ``GEOSERVER_FREEMARKER_API_EXPOSED``\n\nThese application properties default to restricting the objects template authors can access, and limit access to \"getter\" methods used to ","public_affected_ranges":["< 2.27.0"]},{"certainty":"source_listed","source_ids":["sr-5936c572845174f5cc1e5579fd3b318d"],"technology":"org.geoserver:gs-wms","known_exclusions":[],"conditions_summary":"### Summary\nA server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a plain GeoServer instance (no extension or community modules) for WMS GetFeatureInfo HTML and JSON and WMS GetMap KML and GeoRSS output formats.\n\n### Details\nThe org.geoserver.template.TemplateUtils.getSafeConfiguration() method attempts to block access to the class freemarker.template.utility.Execute but it is still possible to gain access to it and other sensitive functionality by chaining a specific sequence of method calls.\n\n### Impact\nThis vulnerability can lead to executing arbitrary code and reading and writing arbitrary files.\n\n### Resolution\nGeoServer 2.27.0 addresses this vulnerability with several new application properties:\n\n* ``GEOSERVER_FREEMARKER_BLOCK_LIST``\n* ``GEOSERVER_FREEMARKER_ALLOW_LIST``\n* ``GEOSERVER_FREEMARKER_API_EXPOSED``\n\nThese application properties default to restricting the objects template authors can access, and limit access to \"getter\" methods used to ","public_affected_ranges":["< 2.27.0"]},{"certainty":"source_listed","source_ids":["sr-5936c572845174f5cc1e5579fd3b318d"],"technology":"org.geoserver.web:gs-web-app","known_exclusions":[],"conditions_summary":"### Summary\nA server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a plain GeoServer instance (no extension or community modules) for WMS GetFeatureInfo HTML and JSON and WMS GetMap KML and GeoRSS output formats.\n\n### Details\nThe org.geoserver.template.TemplateUtils.getSafeConfiguration() method attempts to block access to the class freemarker.template.utility.Execute but it is still possible to gain access to it and other sensitive functionality by chaining a specific sequence of method calls.\n\n### Impact\nThis vulnerability can lead to executing arbitrary code and reading and writing arbitrary files.\n\n### Resolution\nGeoServer 2.27.0 addresses this vulnerability with several new application properties:\n\n* ``GEOSERVER_FREEMARKER_BLOCK_LIST``\n* ``GEOSERVER_FREEMARKER_ALLOW_LIST``\n* ``GEOSERVER_FREEMARKER_API_EXPOSED``\n\nThese application properties default to restricting the objects template authors can access, and limit access to \"getter\" methods used to ","public_affected_ranges":["< 2.27.0"]}],"null_published_at":"2026-11-03T10:03:26.568Z","source_updated_at":"2026-08-19T19:31:57.000Z","source_disclosed_at":"2026-08-19T19:31:54.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:14:33.912Z"}],"next_cursor":null,"snapshot_revision":"42594"}