GeoNetwork updates close unauthenticated RCE path in geoportals

GeoNetwork has released versions 4.4.12 and 4.2.17 to fix two vulnerabilities that can be chained into unauthenticated remote code execution on its open-source geospatial metadata catalogue. The issues affect a platform used in Spatial Data Infrastructure deployments, including the backend of the European INSPIRE geoportal.

The fixes were shipped on July 8, 2026, and vulnerability details were published on August 31. GeoNetwork originated at the United Nations Food and Agriculture Organization and is maintained under the Open Source Geospatial Foundation (OSGeo).

Upload access and XSLT execution form the chain

The first issue, CVE-2026-63219, has a CVSS score of 8.6. It is a missing authorization check on the formatter upload endpoint, allowing an unauthenticated user to write arbitrary .xsl or .zip formatter files into GeoNetwork's formatter directory.

The second, CVE-2026-58400, is rated 9.1 and concerns the configuration of the Saxon XSLT processor used to render formatters. Secure processing is enabled and Java extension functions are disabled, but a loaded stylesheet can still invoke java.lang.Runtime.exec() or java.lang.ProcessBuilder to run operating-system commands as the GeoNetwork process user.

On its own, the XSLT issue requires privileges to upload a formatter. Combined with the exposed upload endpoint, that requirement is removed: an attacker can upload a malicious formatter and then send a GET request for a public record to cause the Saxon engine to process it and execute code.

Affected releases and exposure

Security company Ethiack, whose researcher Rafael Castilho reported the flaws, said the chain is reachable from version 4.0.6, when the formatter endpoint was refactored and the authorization line was dropped. All 4.4.x releases through 4.4.11 and all 4.2.x releases through 4.2.16 are affected.

Ethiack fingerprinted 121 internet-exposed deployments running affected versions across 39 countries. It said 89% appeared to be connected with government, military or national-agency organisations. These figures identify exposed vulnerable instances, not confirmed compromises, and originate from the vendor's fingerprinting.

Upgrade priority and temporary controls

GeoNetwork has urged users to upgrade to 4.4.12 or 4.2.17 as soon as possible. For environments that cannot yet patch, administrators can block write methods to the formatter endpoint at the reverse proxy, although this also prevents legitimate formatter uploads through the administrative console.

• Apache httpd deployments can deny POST, PUT and PATCH requests to /geonetwork/srv/api/formatters.
• Nginx deployments can restrict that location to GET, HEAD and OPTIONS methods.

There was no reference to these vulnerabilities in CISA's Known Exploited Vulnerabilities catalogue at disclosure, and no public reporting of exploitation in the wild. Organisations running GeoNetwork should identify exposed instances, apply the fixed release, and use method restrictions as a temporary control where upgrades require additional change management.