OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a spe…

OSGeo GeoServer contains an XML External Entity (XXE) vulnerability in the /geoserver/wms GetMap operation endpoint. The vulnerability allows attackers to define external entities within XML requests due to improper restriction of XML external entity references. This affects an open-source geospatial server component used across multiple products. The vulnerability could potentially allow attackers to access local files, perform server-side request forgery, or cause denial of service through malicious XML input processing.