GeoServer allows an authenticated administrator with security system access to specify an absolute path to a non‑existing file on the Master Password Dump page, causing the server to write a file containing the master password in plaintext. This is a file‑write vulnerability (CWE‑73) that results in credential disclosure and potential compromise of the entire server.

The flaw exists in GeoServer 2.26.x prior to 2.26.4 and in 2.27.x prior to 2.27.3, within the modules org.geoserver.web:gs-web-app and org.geoserver.web:gs-web-sec-core. Installations that have removed or disabled the Web interface are not affected.

The CVSS score is 7.2, indicating high severity. EPSS is unavailable and the vulnerability is not listed in KEV. Exploitation requires valid administrator credentials and access to the security system. The attack path involves providing an absolute file name for a new file; the target file cannot already exist and the parent directories must exist. No public exploit is known, but the high impact data exposure warrants immediate action.