{"items":[{"id":"NVI-00016145","kind":"vulnerability","title":"GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-7qmg-grcp-qf25","CVE-2025-52465"],"plain_summary":"GitHub lists this reviewed advisory for org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core, org.geoserver.web:gs-web-sec-core, org.geoserver.web:gs-web-app. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-178d9ee1080288ea4540c19255d8c75d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-15T21:49:58.000Z","value":"7.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2fc4c191b9c9d1c8ec20c1141377a425"},{"kind":"CVSS","as_of":"2026-10-06T22:10:00.247Z","value":"7.2 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-178d9ee1080288ea4540c19255d8c75d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2fc4c191b9c9d1c8ec20c1141377a425","url":"https://github.com/advisories/GHSA-7qmg-grcp-qf25","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7qmg-grcp-qf25","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:43.724Z"},{"id":"sr-178d9ee1080288ea4540c19255d8c75d","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52465","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2025-52465","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-06T15:14:01.664Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2fc4c191b9c9d1c8ec20c1141377a425"],"technology":"org.geoserver.web:gs-web-app","known_exclusions":[],"conditions_summary":"### Summary\nA vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist.\n\n### Details\nWhen dumping the master password, GeoServer will use the provided file name with minimal validation as long as it is a java.io.File path. The only limitation is that the fix for a previous, unrelated vulnerability prevents relative path traversal here but absolute paths can be used to access arbitrary files. GeoServer does not enforce a maximum password length by default which allows an administrator to place malicious code into their password which could then be dumped into a JSP file.\n\n### Impact\n#### Remote Code Execution (High severity)\nThis vulnerability can lead to executing arbitrary code if GeoServer is deployed in an environment where an attacker can dynamically deploy and execute a JSP file. This is possible if the geoserver.war file is simply placed into the webap","public_affected_ranges":[">= 2.27.0, <= 2.27.2"]},{"certainty":"source_listed","source_ids":["sr-2fc4c191b9c9d1c8ec20c1141377a425"],"technology":"org.geoserver.web:gs-web-sec-core","known_exclusions":[],"conditions_summary":"### Summary\nA vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist.\n\n### Details\nWhen dumping the master password, GeoServer will use the provided file name with minimal validation as long as it is a java.io.File path. The only limitation is that the fix for a previous, unrelated vulnerability prevents relative path traversal here but absolute paths can be used to access arbitrary files. GeoServer does not enforce a maximum password length by default which allows an administrator to place malicious code into their password which could then be dumped into a JSP file.\n\n### Impact\n#### Remote Code Execution (High severity)\nThis vulnerability can lead to executing arbitrary code if GeoServer is deployed in an environment where an attacker can dynamically deploy and execute a JSP file. This is possible if the geoserver.war file is simply placed into the webap","public_affected_ranges":[">= 2.27.0, <= 2.27.2"]},{"certainty":"source_listed","source_ids":["sr-2fc4c191b9c9d1c8ec20c1141377a425"],"technology":"org.geoserver.web:gs-web-sec-core","known_exclusions":[],"conditions_summary":"### Summary\nA vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist.\n\n### Details\nWhen dumping the master password, GeoServer will use the provided file name with minimal validation as long as it is a java.io.File path. The only limitation is that the fix for a previous, unrelated vulnerability prevents relative path traversal here but absolute paths can be used to access arbitrary files. GeoServer does not enforce a maximum password length by default which allows an administrator to place malicious code into their password which could then be dumped into a JSP file.\n\n### Impact\n#### Remote Code Execution (High severity)\nThis vulnerability can lead to executing arbitrary code if GeoServer is deployed in an environment where an attacker can dynamically deploy and execute a JSP file. This is possible if the geoserver.war file is simply placed into the webap","public_affected_ranges":["<= 2.26.3"]},{"certainty":"source_listed","source_ids":["sr-2fc4c191b9c9d1c8ec20c1141377a425"],"technology":"org.geoserver.web:gs-web-app","known_exclusions":[],"conditions_summary":"### Summary\nA vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist.\n\n### Details\nWhen dumping the master password, GeoServer will use the provided file name with minimal validation as long as it is a java.io.File path. The only limitation is that the fix for a previous, unrelated vulnerability prevents relative path traversal here but absolute paths can be used to access arbitrary files. GeoServer does not enforce a maximum password length by default which allows an administrator to place malicious code into their password which could then be dumped into a JSP file.\n\n### Impact\n#### Remote Code Execution (High severity)\nThis vulnerability can lead to executing arbitrary code if GeoServer is deployed in an environment where an attacker can dynamically deploy and execute a JSP file. This is possible if the geoserver.war file is simply placed into the webap","public_affected_ranges":["<= 2.26.3"]}],"null_published_at":"2026-11-07T18:43:12.069Z","source_updated_at":"2026-07-15T21:49:58.000Z","source_disclosed_at":"2026-06-12T18:23:28.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-04T09:59:43.724Z"},{"id":"NVI-00016145","kind":"vulnerability","title":"GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7qmg-grcp-qf25","CVE-2025-52465"],"plain_summary":"GitHub lists this reviewed advisory for org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core, org.geoserver.web:gs-web-sec-core, org.geoserver.web:gs-web-app. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2fc4c191b9c9d1c8ec20c1141377a425"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-15T21:49:58.000Z","value":"7.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2fc4c191b9c9d1c8ec20c1141377a425"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2fc4c191b9c9d1c8ec20c1141377a425","url":"https://github.com/advisories/GHSA-7qmg-grcp-qf25","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7qmg-grcp-qf25","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:43.724Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2fc4c191b9c9d1c8ec20c1141377a425"],"technology":"org.geoserver.web:gs-web-app","known_exclusions":[],"conditions_summary":"### Summary\nA vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist.\n\n### Details\nWhen dumping the master password, GeoServer will use the provided file name with minimal validation as long as it is a java.io.File path. The only limitation is that the fix for a previous, unrelated vulnerability prevents relative path traversal here but absolute paths can be used to access arbitrary files. GeoServer does not enforce a maximum password length by default which allows an administrator to place malicious code into their password which could then be dumped into a JSP file.\n\n### Impact\n#### Remote Code Execution (High severity)\nThis vulnerability can lead to executing arbitrary code if GeoServer is deployed in an environment where an attacker can dynamically deploy and execute a JSP file. This is possible if the geoserver.war file is simply placed into the webap","public_affected_ranges":[">= 2.27.0, <= 2.27.2"]},{"certainty":"source_listed","source_ids":["sr-2fc4c191b9c9d1c8ec20c1141377a425"],"technology":"org.geoserver.web:gs-web-sec-core","known_exclusions":[],"conditions_summary":"### Summary\nA vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist.\n\n### Details\nWhen dumping the master password, GeoServer will use the provided file name with minimal validation as long as it is a java.io.File path. The only limitation is that the fix for a previous, unrelated vulnerability prevents relative path traversal here but absolute paths can be used to access arbitrary files. GeoServer does not enforce a maximum password length by default which allows an administrator to place malicious code into their password which could then be dumped into a JSP file.\n\n### Impact\n#### Remote Code Execution (High severity)\nThis vulnerability can lead to executing arbitrary code if GeoServer is deployed in an environment where an attacker can dynamically deploy and execute a JSP file. This is possible if the geoserver.war file is simply placed into the webap","public_affected_ranges":[">= 2.27.0, <= 2.27.2"]},{"certainty":"source_listed","source_ids":["sr-2fc4c191b9c9d1c8ec20c1141377a425"],"technology":"org.geoserver.web:gs-web-sec-core","known_exclusions":[],"conditions_summary":"### Summary\nA vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist.\n\n### Details\nWhen dumping the master password, GeoServer will use the provided file name with minimal validation as long as it is a java.io.File path. The only limitation is that the fix for a previous, unrelated vulnerability prevents relative path traversal here but absolute paths can be used to access arbitrary files. GeoServer does not enforce a maximum password length by default which allows an administrator to place malicious code into their password which could then be dumped into a JSP file.\n\n### Impact\n#### Remote Code Execution (High severity)\nThis vulnerability can lead to executing arbitrary code if GeoServer is deployed in an environment where an attacker can dynamically deploy and execute a JSP file. This is possible if the geoserver.war file is simply placed into the webap","public_affected_ranges":["<= 2.26.3"]},{"certainty":"source_listed","source_ids":["sr-2fc4c191b9c9d1c8ec20c1141377a425"],"technology":"org.geoserver.web:gs-web-app","known_exclusions":[],"conditions_summary":"### Summary\nA vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist.\n\n### Details\nWhen dumping the master password, GeoServer will use the provided file name with minimal validation as long as it is a java.io.File path. The only limitation is that the fix for a previous, unrelated vulnerability prevents relative path traversal here but absolute paths can be used to access arbitrary files. GeoServer does not enforce a maximum password length by default which allows an administrator to place malicious code into their password which could then be dumped into a JSP file.\n\n### Impact\n#### Remote Code Execution (High severity)\nThis vulnerability can lead to executing arbitrary code if GeoServer is deployed in an environment where an attacker can dynamically deploy and execute a JSP file. This is possible if the geoserver.war file is simply placed into the webap","public_affected_ranges":["<= 2.26.3"]}],"null_published_at":"2026-11-04T10:04:27.898Z","source_updated_at":"2026-07-15T21:49:58.000Z","source_disclosed_at":"2026-06-12T18:23:28.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T09:59:43.724Z"}],"next_cursor":null,"snapshot_revision":"42594"}