GeoNetwork, an open-source geospatial metadata catalog utilized by various government and military organizations, has been found vulnerable to an unauthenticated remote code execution (RCE) chain. The vulnerability stems from two flaws: CVE-2026-63219, a missing authorization check on the formatter upload endpoint, and CVE-2026-58400, an unsafe configuration of the Saxon XSLT processor. Together, these allow an anonymous attacker to upload malicious files and execute arbitrary system commands via a standard GET request.
Project maintainers released patches in versions 4.4.12 and 4.2.17 following reports by security researchers from Ethiack. Approximately 121 internet-exposed deployments were identified globally, with a high concentration belonging to national agencies. Organizations unable to patch immediately are advised to restrict POST, PUT, and PATCH requests to the formatter API endpoint at the reverse proxy level to mitigate potential exploitation.
Top comments (0)