Read the docs
TI-2023-11277 Aliases CVE-2023-26043GHSA-mcmc-c59m-pqq8

XML External Entity (XXE) injection in GeoServer style upload functionality

Priority MEDIUM 62CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.

Summary

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00836 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed geonode (GeoNode): 4.0.3GeoNode (PyPI): 4.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GeoNodegeonodebefore 4.0.34.0.3Patch availableCNA
—GeoNode (PyPI)before 4.0.34.0.3Patch availableGHSA-mcmc-c59m-pqq8
  • geonode VendorGeoNode Affected before 4.0.3 Fixed in 4.0.3 Patch available CNA
  • GeoNode (PyPI) Vendor— Affected before 4.0.3 Fixed in 4.0.3 Patch available GHSA-mcmc-c59m-pqq8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:geosolutionsgroup:geonode:*:*:*:*:*:*:*:*before 4.0.3VulnerableGeoNode
  • cpe:2.3:a:geosolutionsgroup:geonode:*:*:*:*:*:*:*:* Versions before 4.0.3 Vulnerable ·GeoNode

Remediation

  • Fix · CNA geonode (GeoNode) Fixed in 4.0.3
  • Fix · GHSA-mcmc-c59m-pqq8 GeoNode (PyPI) Fixed in 4.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26043
  2. 2026-10-03 Alias added: GHSA-mcmc-c59m-pqq8

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2023-22605 GeoNode SSRF Bypass to return internal host data CVSS 3.1HIGH 7.5
  • TI-2023-20907 Geonode Server Side Request Forgery vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-12986 Geoserver for GeoNode sensitive information leak CVSS 3.1HIGH 7.5
  • TI-2024-17952 GeoNode stored XSS to full account takeover CVSS 3.1MEDIUM 6.1
  • TI-2026-28791 GeoNode SSRF via Service Registration CVSS 4.0MEDIUM 5.3
  • TI-2026-28790 GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences