GeoNode: Unrestricted File Upload
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.
Summary
GeoNode, a geospatial content management system, has an unrestricted file upload flaw (CWE-434) in versions before 5.0.3. Specially crafted requests can circumvent the upload service validation, allowing a low-privileged remote user to store and serve malicious files. The CVSS 3.1 base score is 5.5 (MEDIUM).
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GeoNode | geonode | before 5.0.3 | 5.0.3 | Patch available | CNA |
| — | GeoNode (PyPI) | before 5.0.3 | 5.0.3 | Patch available | GHSA-fqpv-mq26-pr4j |
- geonode VendorGeoNode Affected before 5.0.3 Fixed in 5.0.3 Patch available CNA
- GeoNode (PyPI) Vendor— Affected before 5.0.3 Fixed in 5.0.3 Patch available GHSA-fqpv-mq26-pr4j
Remediation
Upgrade GeoNode to version 5.0.3, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA geonode (GeoNode) Fixed in 5.0.3
- Fix · GHSA-fqpv-mq26-pr4j GeoNode (PyPI) Fixed in 5.0.3 Advisory →
Timeline
- 2026-11-06 Threatist record created from CVE-2026-46429
- 2026-11-06 Alias added: GHSA-fqpv-mq26-pr4j
- 2026-11-06 Fix available: PyPI/[email protected] · GHSA-fqpv-mq26-pr4j
- 2026-11-06 CVSS score added · GHSA-fqpv-mq26-pr4j
- 2026-11-06 Weakness changed · GHSA-fqpv-mq26-pr4j
- 2026-11-06 7 new references · GHSA-fqpv-mq26-pr4j
- 2026-11-08 Priority changed: MEDIUM → LOW
References
Other 7
- https://github.com/GeoNode/geonode/security/advisories/GHSA-fqpv-mq26-pr4j
- https://github.com/GeoNode/geonode/pull/14223
- https://github.com/GeoNode/geonode/pull/14224
- https://github.com/GeoNode/geonode/commit/16ec8b3914fe87d0a258c14cf73b0a4295bb072f
- https://github.com/GeoNode/geonode/commit/239a6b49c925957197033831df5f20c4c13a14da
- https://github.com/GeoNode/geonode/releases/tag/5.0.3
- https://github.com/GeoNode/geonode
More GeoNode vulnerabilities
- TI-2022-08629 Improper Control of Generation of Code in jai-ext KEVCVSS 3.1CRITICAL 10.0
- TI-2023-22605 GeoNode SSRF Bypass to return internal host data CVSS 3.1HIGH 7.5
- TI-2023-11277 XML External Entity (XXE) injection in GeoServer style upload functionality CVSS 3.1MEDIUM 6.5
- TI-2023-20907 Geonode Server Side Request Forgery vulnerability CVSS 3.1HIGH 7.5
- TI-2023-12986 Geoserver for GeoNode sensitive information leak CVSS 3.1HIGH 7.5
- TI-2026-86095 OS command injection in GeoNode via uploaded vector layer name CVSS 3.1HIGH 8.8
Sources
- CVE-2026-46429 · CVE Program
- CVE-2026-46429 · NVD
- FIRST EPSS
- GHSA-fqpv-mq26-pr4j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences