GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| geonetwork | core-geonetwork | 4.3.0 to before 4.4.12; before 4.2.17 | 4.4.12, 4.2.17 | Patch available | CNA |
- core-geonetwork Vendorgeonetwork Affected 4.3.0 to before 4.4.12; before 4.2.17 Fixed in 4.4.12, 4.2.17 Patch available CNA
Remediation
- Fix · CNA core-geonetwork (geonetwork) Fixed in 4.4.12, 4.2.17
Timeline
- 2026-10-02 Threatist record created from CVE-2026-58400
References
Other 4
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r
- https://docs.geonetwork-opensource.org/4.2/overview/change-log/version-4.2.17
- https://docs.geonetwork-opensource.org/4.4/overview/change-log/version-4.4.12
- https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html
More geonetwork vulnerabilities
- TI-2026-45097 Unauthenticated file upload via missing authorization on formatter upload endpoint CVSS 3.1HIGH 8.6
- TI-2022-26353 Geonetwork 4.2.0 - XML External Entity (XXE) CVSS 4.0HIGH 8.7
- TI-2026-40323 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool CVSS 4.0HIGH 7.8
- TI-2026-84467 Access control bypass in GeoNetwork Elasticsearch search proxy CVSS 3.1HIGH 7.5
- TI-2006-05324 SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers… CVSS 2.0HIGH 7.5
- TI-2026-84477 Reflected XSS in GeoNetwork through AngularJS template injection CVSS 3.1HIGH 7.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences