Overview
In mid-2025, GeoNetwork was found to be affected by a critical XML External Entity (XXE) vulnerability, tracked as CVE-2025-30220. The flaw originated from the gt-xsd-core module in GeoTools, a dependency shared with GeoServer.
Impact
Exploitation could allow attackers to craft malicious XML payloads that access local files or trigger outbound network requests. This may lead to data exposure or SSRF (Server-Side Request Forgery).
Mitigation
- Update to GeoNetwork 4.4.8 or 4.2.13 and newer.
- Restrict external entity resolution in XML parsers.
- Block unauthorized outbound connections from the server.
- Enable WAF rules to detect XML-based exploits.
Patched in: GeoNetwork 4.4.8, 4.2.13.
CVE-2025-30220 — NVD Reference
GeoSecureTech Support
Our experts offer GeoNetwork security audits, configuration reviews, and secure deployment training to prevent exploitation of metadata and catalog services.