CVE-2025-27511

HighCVSS 7.2/10Last modified Oct 6, 2026

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jun 18, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-275122.1Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actio CVE-2025-275137.5OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of CVE-2025-275145.4GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2025-275159.8Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted m CVE-2025-275168.8Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filte CVE-2025-275179.3Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code exe CVE-2025-275186.9Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. An CVE-2025-275199.3Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A CVE-2025-27528.8A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_ator CVE-2025-275209.8BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vul CVE-2025-275215.5Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affec CVE-2025-275226.5Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnera