{"uuid": "d3a9a3be-7e46-44d6-a018-982d32551a2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "name": "GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends", "description": "# GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends\nVulnerability / Web Security\n\n[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWjRcj8Bn8kWovv1-oDjSP61hMxx5U8u28qVJSPdP7mRBCNbs5EJjjDrWWk7SFC2FraZe_j3T-oouRqSRtoTr-YMPGGuOphIGNRj4-Fx0eVgMahD3-L62vWUxYLg7TpH7plqVqnAb1e3k0-G8Vertd-WUyt994d-nJKA8bcY9QozeWJ6ad4ozwVOf0fnE/s1600/geone.gif)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWjRcj8Bn8kWovv1-oDjSP61hMxx5U8u28qVJSPdP7mRBCNbs5EJjjDrWWk7SFC2FraZe_j3T-oouRqSRtoTr-YMPGGuOphIGNRj4-Fx0eVgMahD3-L62vWUxYLg7TpH7plqVqnAb1e3k0-G8Vertd-WUyt994d-nJKA8bcY9QozeWJ6ad4ozwVOf0fnE/s1600/geone.gif)\n\nTwo vulnerabilities in **GeoNetwork** can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals.\n\nThe project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31.\n\nGeoNetwork originated at the United Nations Food and Agriculture Organization and is maintained under the Open Source Geospatial Foundation (OSGeo). It is a core component of many Spatial Data Infrastructure deployments across Europe and beyond, including the backend of the European INSPIRE geoportal.\n\nThe chain combines a missing authorization check with an unsafe transformation engine. The first flaw, **CVE-2026-63219** (CVSS score: 8.6), is a missing authorization check on the formatter upload endpoint.\n\nThe unauthenticated file upload flaw allows an anonymous user to write arbitrary\u00a0.xsl\u00a0or\u00a0.zip\u00a0formatter files to the GeoNetwork formatter directory, which, on its own, constitutes unauthorized write access to server storage.\n\n\"An unauthenticated attacker can upload arbitrary\u00a0.xsl\u00a0or\u00a0.zip\u00a0formatter files to the server,\" the project said in\u00a0[the advisory](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42).\n\nThe second flaw, CVE-2026-58400 (CVSS score: 9.1), is an\u00a0[unsafe configuration of the Saxon](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r)\u00a0Extensible Stylesheet Language Transformations (XSLT) processor used to render formatters.\n\nThe engine runs with secure processing enabled and Java extension functions disabled, so any stylesheet it loads can call\u00a0java.lang.Runtime.exec() or java.lang.ProcessBuilder and run operating-system commands as the GeoNetwork process user.\n\nOn its own, that second flaw requires privileges to upload a formatter, which is why it is scored as needing high privileges. Chaining it with the upload flaw removes that precondition, because the upload is reachable without authentication.\n\n[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJOdCLNcunQXdDyN7r6M69wVIVN9lCdvh-HTmIydTihXsUKQAHKfPc5F7ShFXKJG1OgClZe6txs3SoHbUTIte_YdK0xQGJvEzGolc_zOKqq9zloeNlwSyLVCHsPbyKW1Uc9RAah36L7XkekjTnQC60KZGarSXTEMoomuRUXFAi-bCgA87GlAelMwF_1Vo/s1600/geo-1.jpg)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJOdCLNcunQXdDyN7r6M69wVIVN9lCdvh-HTmIydTihXsUKQAHKfPc5F7ShFXKJG1OgClZe6txs3SoHbUTIte_YdK0xQGJvEzGolc_zOKqq9zloeNlwSyLVCHsPbyKW1Uc9RAah36L7XkekjTnQC60KZGarSXTEMoomuRUXFAi-bCgA87GlAelMwF_1Vo/s1600/geo-1.jpg)\n\nAn attacker first uploads a malicious formatter through the unprotected endpoint. A follow-up GET request to a public record then triggers the Saxon engine to execute the stylesheet, which delivers code execution. Security vendor Ethiack, whose researcher Rafael Castilho\u00a0[reported the flaws](https://ethiack.com/info-hub/research/geonetwork-preauth-RCE), said the chain is reachable starting with version 4.0.6, when the formatter endpoint was refactored, and the authorization line was dropped.\n\nEthiack said it fingerprinted 121 internet-exposed GeoNetwork deployments running affected versions across 39 countries, and that 89 percent of them were government-, military-, or national-agency-related.\n\nThose figures describe exposed instances running vulnerable versions, not confirmed victims or compromises, and the fingerprinting is single-sourced to the vendor.\n\nAll 4.4.x releases up to and including 4.4.11 and all 4.2.x releases up to and including 4.2.16 are affected, and the flaws are fixed in 4.4.12 and 4.2.17.\n\n\"All users are strongly encouraged to upgrade to 4.4.12 or 4.2.17 as soon as possible,\" the project said in its release announcement.\n\nUntil the update is applied, administrators can block write methods to the formatter endpoint at the reverse proxy, thereby blocking legitimate formatter uploads through the admin console.\n\nThe advisory lists the following interim rules -\n\n*   **Apache httpd**\u00a0- deny\u00a0POST,\u00a0PUT, and\u00a0PATCH\u00a0requests to the\u00a0/geonetwork/srv/api/formatters\u00a0location.\n*   **Nginx**\u00a0- restrict the same location to\u00a0GET,\u00a0HEAD, and\u00a0OPTIONS\u00a0methods.\n\nThe flaws were fixed roughly eight weeks before the advisories were published. The Hacker News found no reference to the GeoNetwork flaws in CISA's Known Exploited Vulnerabilities catalog as of the disclosure, and no public reporting of exploitation in the wild.\n\nThe disclosure follows a run of security issues across the wider geospatial stack. Last year, a critical GeoServer flaw (CVE-2024-36401, CVSS score: 9.8) was\u00a0[exploited into botnets](https://thehackernews.com/2024/09/geoserver-vulnerability-targeted-by.html), cryptocurrency miners, and the SideWalk backdoor, and a GeoServer XML External Entity (XXE) flaw (CVE-2025-58360) was\u00a0[added to CISA's KEV catalog](https://thehackernews.com/2025/12/cisa-flags-actively-exploited-geoserver.html)\u00a0in December 2025 after evidence of active exploitation. Last month, a separate unauthenticated SQL injection to RCE in GeoServer, disclosed as\u00a0[a GeoServer zero-day](https://thehackernews.com/2026/08/unpatched-geoserver-zero-day-targeted.html), came under active probing shortly after it went public.\n\nFound this article interesting? Follow us on [Google News](https://news.google.com/publications/CAAqLQgKIidDQklTRndnTWFoTUtFWFJvWldoaFkydGxjbTVsZDNNdVkyOXRLQUFQAQ), [Twitter](https://twitter.com/thehackersnews) and [LinkedIn](https://www.linkedin.com/company/thehackernews/) to read more exclusive content we post.", "creation_timestamp": "2026-09-03T12:28:54.063015+00:00", "timestamp": "2026-09-03T12:28:54.063015+00:00", "related_vulnerabilities": ["CVE-2026-63219", "GHSA-mh22-prqr-vf42", "CVE-2026-58400", "CVE-2025-58360", "CVE-2024-36401", "GHSA-x898-729x-cc3r"], "author": {"login": "adulau", "name": "Alexandre Dulaunoy", "uuid": "c933734a-9be8-4142-889e-26e95c752803"}}