Vulnerabilities

TI-2022-26353 CVE-2022-50899 · GHSA-q595-r7rh-mc9h

Geonetwork 4.2.0 - XML External Entity (XXE)

MEDIUM 44

Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00551 Published 2026-01-13 No fix listed CWE-611

TI-2025-21556 CVE-2025-30220 · GHSA-jj54-8f66-c5pc

GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

HIGH 77

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.43616 Published 2025-06-10 Fixed in 2.27.1, 2.26.3 +1 CWE-611

TI-2024-21128 CVE-2024-32037 · GHSA-52rf-25hq-5m33

GeoNetwork vulnerable to search end-point information disclosure in response headers

LOW 30

GeoNetwork is a catalog application to manage spatially referenced resources.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00377 Published 2025-02-11 Fixed in 4.2.10, 4.4.5 CWE-200

TI-2021-09537 CVE-2021-28398

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the…

LOW 35

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01457 Published 2022-09-05 No fix listed CWE-78

Vulnerabilities

Filters

Geonetwork 4.2.0 - XML External Entity (XXE)

GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

GeoNetwork vulnerable to search end-point information disclosure in response headers

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the…