GeoServer version 2.25.1 suffers from a PHP code injection vulnerability.