EUVD-2026-21579
GHSA-x87c-g7pw-2xr5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.
AnalysisAI
Server-side request forgery in GeoNode 4.0-4.4.4 and 5.0-5.0.1 allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by supplying a malicious URL via the doc_url parameter, enabling attacks against internal network resources, loopback addresses, RFC1918 networks, and cloud metadata services without SSRF mitigations. CVSS 5.3 reflects low confidentiality and integrity impact but requires prior authentication; no public exploit code or active exploitation has been identified.
Technical ContextAI
The vulnerability resides in GeoNode's document upload handler, which processes the doc_url parameter without proper validation or filtering of destination IP ranges and redirect chains. GeoNode is a Django-based geospatial data management platform (CPE: cpe:2.3:a:geonode:geonode). The root cause is classified as CWE-918 (Server-Side Request Forgery), which allows the application server to be weaponized as a proxy for internal network reconnaissance and data exfiltration. The absence of controls such as private IP range blocking (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) and validation of HTTP redirect targets creates a direct path to cloud metadata endpoints (AWS IMDSv2, GCP metadata service, Azure IMDS) and internal services.
RemediationAI
Upgrade GeoNode to version 4.4.5 or later for the 4.x series, or version 5.0.2 or later for the 5.x series. Patch releases are available from the official GitHub repository (https://github.com/GeoNode/geonode/releases). Pending patch deployment, implement network-level controls by restricting outbound HTTP/HTTPS requests from the GeoNode application server to external destinations, and configure firewall rules to block requests to private IP ranges (RFC1918, loopback, link-local) and cloud metadata endpoints. Review document upload role assignments to minimize the number of authenticated users with upload privileges.
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
GeoNode 4.0 before 4.4.5 and 5.0 before 5.0.2 contains a server-side request forgery vulnerability in the service regist
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today