GeoNode EUVD-2026-118478

Requires an authenticated low-privileged GeoNode account (CVSS PR:L) with permission to use the document upload service. Exploitation works by sending specially crafted requests that circumvent the upload service's validation; the patch indicates the exposure was in the documents DRF API serializer path where file name/extension could be influenced, so the fix locks those fields read-only and disables direct POST/PUT document creation. Realized impact is further limited by required user interaction (UI:R) - a separate victim must access the stored/served malicious file. The precise request format used to bypass validation is not detailed in the available sources. Limiting factors: valid account prerequisite, victim interaction requirement, and affected versions <= 5.0.2.

This is a medium-severity (CVSS 5.5) unrestricted file upload (CWE-434) in GeoNode, and the signals consistently point to a moderate, non-emergency priority rather than a top-tier threat. The vendor-provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) indicates network-reachable but authenticated exploitation: PR:L means a valid low-privileged account is required, and UI:R means a victim must interact with the stored/served file for impact to be realized, and all three impacts are only Low. No KEV listing is present, so there is no confirmed active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The references are limited to the GitHub Security Advisory, two fix PRs, two commits, and the 5.0.3 release - these are remediation artifacts, not exploit code, so no public working exploit is indicated. The vuln.today decision label is 'this_month', which aligns with the moderate CVSS and absence of KEV/EPSS escalation. Net: a genuine issue worth patching on a normal cycle, not a drop-everything emergency, and its real-world reach is further bounded by GeoNode's niche deployment footprint.

A remote attacker who already holds a low-privileged GeoNode account sends specially crafted requests that bypass the upload service's file validation, storing a malicious file that GeoNode will then serve. When another user interacts with (downloads or opens) the served file, the limited confidentiality/integrity/availability impact is realized. No public exploit code was identified in the provided references - only the advisory and patch artifacts.