HIGH 7.2 GitHub
CVE-2024-45747
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
### Summary
A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a plain GeoServer instance (no extension or community modules) for WMS GetFeatureInfo HTML and JSON and WMS GetMap KML and GeoRSS output formats.
### Details
The org.geoserver.template.TemplateUtils.
Affected Products
- maven/org.geoserver:gs-main < 2.27.0
- maven/org.geoserver:gs-wms < 2.27.0
- maven/org.geoserver.web:gs-web-app < 2.27.0
References
- https://github.com/advisories/GHSA-wf6j-gr27-g7ch
- https://github.com/geoserver/geoserver/security/advisories/GHSA-wf6j-gr27-g7ch
- https://github.com/geoserver/geoserver/pull/8164
- https://docs.geoserver.org/latest/en/user/tutorials/GetFeatureInfo/html/#accessing-instanc
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-08-19 via GitHub. Affected: maven/org.geoserver:gs-main < 2.27.0, maven/org.geoserver:gs-wms < 2.27.0, maven/org.geoserver.web:gs-web-app < 2.27.0.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.