{"id":"GHSA-826p-4gcg-35vw","summary":"GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling","details":"### Summary\n\nGeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.\n\n### Impact\n\nThis impacts whoever exposes XML processing with ``gt-xsd-core`` involved in parsing, when the documents carry a reference to an external XML schema. The ``gt-xsd-core`` Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured).\n\nThis also impacts users of ``gt-wfs-ng`` DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended.\n\n### Resolution\n\nGeoTools API change allows EntityResolver to be supplied to the following methods:\n\n```java\nSchemas.parse( location, locators, resolvers, uriHandlers, entityResolver);\nSchemas.findSchemas(Configuration configuration, EntityResolver entityResolver);\n```\n\nWith this API change the `gt-wfs-ng` WFS DataStore ENTITY_RESOLVER parameter is now used.\n\n### Reference\n\n* [GHSA-jj54-8f66-c5pc](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc): Describes the impact of the ``gt-xsd-core`` vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files.\n\n* [GHSA-2p76-gc46-5fvc](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc): Describes the impact of the ``gt-wfs-ng`` and ``gt-xsd-core`` vulnerability on the GeoNetwork WFS Index functionality.","modified":"2026-02-04T04:28:18.471515Z","published":"2025-06-09T23:14:48Z","related":["CVE-2025-30220"],"database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-611"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2025-06-09T23:14:48Z"},"references":[{"type":"WEB","url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc"},{"type":"WEB","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc"},{"type":"WEB","url":"https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw"},{"type":"PACKAGE","url":"https://github.com/geotools/geotools"}],"affected":[{"package":{"name":"org.geotools:gt-xsd-core","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-xsd-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"33.0"},{"fixed":"33.1"}]}],"versions":["33.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-826p-4gcg-35vw/GHSA-826p-4gcg-35vw.json"}},{"package":{"name":"org.geotools:gt-xsd-core","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-xsd-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"32.0"},{"fixed":"32.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-826p-4gcg-35vw/GHSA-826p-4gcg-35vw.json"}},{"package":{"name":"org.geotools:gt-xsd-core","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-xsd-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0"},{"fixed":"31.7"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 31.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-826p-4gcg-35vw/GHSA-826p-4gcg-35vw.json"}},{"package":{"name":"org.geotools:gt-wfs-ng","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-wfs-ng"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"33.0"},{"fixed":"33.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-826p-4gcg-35vw/GHSA-826p-4gcg-35vw.json"}},{"package":{"name":"org.geotools:gt-wfs-ng","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-wfs-ng"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"32.0"},{"fixed":"32.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-826p-4gcg-35vw/GHSA-826p-4gcg-35vw.json"}},{"package":{"name":"org.geotools:gt-wfs-ng","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-wfs-ng"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0"},{"fixed":"31.7"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 31.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-826p-4gcg-35vw/GHSA-826p-4gcg-35vw.json"}},{"package":{"name":"org.geotools:gt-xsd-core","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-xsd-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.6.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-826p-4gcg-35vw/GHSA-826p-4gcg-35vw.json"}},{"package":{"name":"org.geotools:gt-wfs-ng","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-wfs-ng"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.6.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-826p-4gcg-35vw/GHSA-826p-4gcg-35vw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L"}]}