Unauthenticated file upload via missing authorization on formatter upload endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| geonetwork | core-geonetwork | 4.3.0 to before 4.4.12; before 4.2.17 | 4.4.12, 4.2.17 | Patch available | CNA |
- core-geonetwork Vendorgeonetwork Affected 4.3.0 to before 4.4.12; before 4.2.17 Fixed in 4.4.12, 4.2.17 Patch available CNA
Remediation
- Fix · CNA core-geonetwork (geonetwork) Fixed in 4.4.12, 4.2.17
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63219
References
Other 5
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42
- https://github.com/geonetwork/core-geonetwork/pull/9346
- https://docs.geonetwork-opensource.org/4.2/overview/change-log/version-4.2.17
- https://docs.geonetwork-opensource.org/4.4/overview/change-log/version-4.4.12
- https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html
More geonetwork vulnerabilities
- TI-2026-42016 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter CVSS 3.1CRITICAL 9.1
- TI-2022-26353 Geonetwork 4.2.0 - XML External Entity (XXE) CVSS 4.0HIGH 8.7
- TI-2026-40323 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool CVSS 4.0HIGH 7.8
- TI-2026-84467 Access control bypass in GeoNetwork Elasticsearch search proxy CVSS 3.1HIGH 7.5
- TI-2006-05324 SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers… CVSS 2.0HIGH 7.5
- TI-2026-84477 Reflected XSS in GeoNetwork through AngularJS template injection CVSS 3.1HIGH 7.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences