CVE-2025-30220

This flaw is like a “file-reader trap” inside the software’s XML checker. If someone sends the server a specially crafted XML message, the server can be tricked into following a pointer to an external XML schema and reading content it shouldn’t. In real terms, that can expose internal information from the system processing that XML.

This matters if your business runs or depends on GeoServer, GeoTools, or GeoNetwork—especially if your setup processes XML with external schema/XSD references. The findings indicate the attack does not require a login and needs no user click, so internet scanning or crafted requests can reach the vulnerable parsing path. Act quickly if your GeoServer/GeoNetwork endpoints are reachable from the network where attackers can send XML inputs (and the XML/XSD schema processing path is in use).

VERDICT: RED. Attackers can send crafted XML over the network without logging in, and the weakness is in core XML schema (XSD) handling—this is exactly the kind of issue that gets automated probing. If you use GeoServer/GeoNetwork/GeoTools in a way that processes external XML schemas, you should upgrade now rather than wait.