GeoNetwork CVE-2026-58400

Exploitation requires an authenticated account with sufficient privileges to upload or edit a formatter/XSLT stylesheet in GeoNetwork (reflected as PR:H), and the vulnerable default Saxon configuration present in versions before 4.4.12/4.2.17 where FEATURE_SECURE_PROCESSING is off and ALLOW_EXTERNAL_FUNCTIONS is on. What limits it: the attacker cannot exploit anonymously - formatter-upload rights are an editor/administrator-level capability - and the flaw is closed in the patched releases, so it applies only to un-upgraded instances. No end-user interaction beyond the malicious stylesheet being rendered is needed (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) reflects network-reachable, low-complexity exploitation but is explicit that high privileges are required (PR:H) - consistent with the description's requirement that the attacker already hold rights to upload a formatter, so this is not an unauthenticated flaw despite the TheHackerNews headline calling it 'unauthenticated RCE.' That conflict should be resolved in the operator's favor by auditing who actually holds formatter-upload rights: any organization running GeoNetwork on sensitive infrastructure - even a mid-sized municipal GIS team in gniezno should treat a full-RCE-from-a-privileged-user issue as urgent and patch promptly. No EPSS score or CISA KEV status was supplied and no POC is referenced, so real-world exploitation pressure appears moderate and gated by the privilege prerequisite; the primary risk is a compromised or over-permissioned editor/admin account converting catalog access into host takeover and lateral movement.

An attacker who obtains or abuses a GeoNetwork account with formatter-upload privileges (or a legitimate but malicious editor) uploads a .xsl formatter containing a Java extension call to Runtime.exec(). When the formatter is rendered, GeoNetwork's Saxon engine executes the embedded call, running attacker-chosen OS commands as the GeoNetwork process user - enabling reverse shells, credential theft, or pivoting. No POC is publicly referenced, but the technique is straightforward given documented Saxon extension-function behavior.