EUVD-2026-70647Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Unauthenticated network upload of XSLT enables Java RCE chain, elevating C and A from N to H beyond the vendor's write-only assessment.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary .xsl or .zip formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
AnalysisAI
Unauthenticated arbitrary file upload in GeoNetwork prior to versions 4.4.12 and 4.2.17 allows remote attackers to write malicious XSLT or ZIP formatter files directly to the server's formatter directory without any authorization check. Because GeoNetwork processes uploaded .xsl formatter files server-side via a Java XSLT engine when rendering metadata records, attackers can weaponize this upload into a remote code execution chain by embedding Java extension function calls within the XSLT payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required: the formatter upload API endpoint is exposed by default on any GeoNetwork installation in the affected version range, and exploitation requires only network access to the HTTP(S) port - no authentication, no specific user interaction, and no non-default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N scores 8.6, reflecting unauthenticated network exploitation with a scope change but limiting impact to integrity (file write). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to GeoNetwork 4.4.12 (see changelog at https://docs.geonetwork-opensource.org/4.4/overview/change-log/version-4.4.12) or GeoNetwork 4.2.17 (https://docs.geonetwork-opensource.org/4.2/overview/change-log/version-4.2.17); these are the vendor-confirmed patched versions per the GHSA advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all GeoNetwork deployments and versions in use; immediately restrict network access to GeoNetwork instances running versions prior to 4.4.12 or 4.2.17, and disable public internet connectivity where feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Geonetwork
View allA remote code execution vulnerability in GeoServer (CVSS 9.9) that allows users. Risk factors: public PoC available. Ven
Arbitrary OS command execution in GeoNetwork before 4.4.12 and 4.2.17 arises because the Saxon XSLT processor that rende
Geonetwork versions up to 4.2.0 is affected by improper restriction of xml external entity reference (CVSS 6.5).
Post-login redirect validation in GeoNetwork's OAuth2/OIDC and Keycloak SSO authentication filters can be bypassed to re
GeoNetwork is a catalog application to manage spatially referenced resources. Rated remotely exploitable, no authenticat
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today