Geoserver Jxpath Rce Cve 2024 36401

Tim Peck@timpeck

•updated Aug 21, 2025•2•16

Detects attempts to exploit a remote code execution vulnerability (CVE-2024-36401) in GeoServer. Attackers leverage crafted JXPath queries in WFS, WMS, or WPS requests to execute arbitrary commands via Java's getRuntime().exec() method.