CVE-2026-46429: CVE-2026-46429: Unrestricted File Upload and Validation Bypass in GeoNode

#security #cve #cybersecurity

CVE-2026-46429: Unrestricted File Upload and Validation Bypass in GeoNode

Vulnerability ID: CVE-2026-46429
CVSS Score: 5.5
Published: 2026-11-06

GeoNode versions prior to 5.0.3 contain an unrestricted file upload vulnerability (CWE-434) within the document and dataset ingestion architecture. Authenticated low-privileged users can bypass upload validation via direct REST API interactions, file extension masquerading, metadata mutation via PATCH requests, or malicious archive submissions. This allows attackers to store and serve dangerous file types, alter on-disk file references, or trigger path traversal and resource exhaustion during archive extraction.

TL;DR

An upload validation bypass in GeoNode (< 5.0.3) allows low-privileged authenticated users to upload arbitrary files, mutate document extensions via the REST API, and submit malicious archives containing path traversal sequences or zip bombs. Upgrade to GeoNode 5.0.3 to enforce magic-byte inspection, archive safety validation, and REST API restrictions.

Technical Details

Vulnerability Type: CWE-434: Unrestricted Upload of File with Dangerous Type
CVSS v3.1 Score: 5.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
Attack Vector: Network (Authenticated HTTP requests to /api/v2/documents/ and /documents/upload/)
Affected Software: GeoNode (geonode) versions prior to 5.0.3
Patched Version: GeoNode 5.0.3
Impact: Arbitrary file upload/serving, metadata manipulation, Zip Slip path traversal, and zip bomb DoS
Exploit Status: No known public exploits or active exploitation
CISA KEV Status: Not Listed

Affected Systems

GeoNode (PyPI package: geonode) < 5.0.3
geonode: < 5.0.3 (Fixed in: 5.0.3)

Code Analysis

Commit: 239a6b4

Cumulative upload improvements (PR #14223): Implement FileValidationUploadHandler magic-byte checks, validate_safe_zip archive inspection, and harden DocumentViewSet REST API.

class DocumentViewSet(ApiPresetsInitializer, DynamicModelViewSet, AdvertisedListMixin):
+    http_method_names = ["get", "patch"]
+    permission_classes = [IsAuthenticatedOrReadOnly, UserHasPerms]

Commit: 16ec8b3

Backport of cumulative upload security improvements to stable release branch (PR #14224).

Mitigation Strategies

Upgrade GeoNode to version 5.0.3 or later to enable magic-byte upload inspection, archive safety validation, and REST API restrictions.
Enforce reverse proxy or WAF rules blocking POST and PUT methods on /api/v2/documents/ and filtering sensitive JSON keys in PATCH requests.
Audit existing uploaded files on disk using libmagic/file utilities to detect MIME-type mismatches against declared file extensions.
Serve user-uploaded documents from an isolated, cookieless domain with Content-Disposition: attachment and X-Content-Type-Options: nosniff headers.

Remediation Steps:

Update the GeoNode Python package to >= 5.0.3 via pip: pip install --upgrade "geonode>=5.0.3".
Verify that system-level libmagic packages are installed on the host or container image.
Check custom local_settings.py files to ensure FILE_UPLOAD_HANDLERS includes geonode.upload.uploadhandler.FileValidationUploadHandler.
Restart Django application servers (Gunicorn/uWSGI) and Celery workers to apply the updated configuration.
Scan the GeoNode uploaded documents directory (e.g., file --mime-type /path/to/uploaded/documents/*) to verify no malicious files were stored prior to patching.

References

Read the full report for CVE-2026-46429 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community