Full Report
Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals. The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31. GeoNetwork originated at the United Nations Food and
Analysis Summary
# Vulnerability: GeoNetwork Unauthenticated RCE via Vulnerability Chaining
## CVE Details
- **CVE ID:** CVE-2026-63219 (Primary Entry), CVE-2026-58400 (Secondary Link)
- **CVSS Score:** 8.6 (High) for CVE-2026-63219; 9.1 (Critical) for CVE-2026-58400
- **CWE:** CWE-285 (Improper Authorization), CWE-94 (Improper Control of Generation of Code)
## Affected Systems
- **Products:** GeoNetwork (Open-source geospatial metadata catalog)
- **Versions:**
- 4.0.6 through 4.4.11
- 4.2.0 through 4.2.16
- **Configurations:** Systems utilizing the formatter engine with internet-exposed endpoints.
## Vulnerability Description
This RCE is achieved by chaining two distinct flaws:
1. **CVE-2026-63219:** A missing authorization check on the `/geonetwork/srv/api/formatters` endpoint. This allows unauthenticated users to upload arbitrary `.xsl` or `.zip` files to the server's formatter directory.
2. **CVE-2026-58400:** An unsafe configuration of the Saxon XSLT processor. The engine fails to adequately restrict Java extension functions, allowing a malicious XSLT stylesheet to call `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder`.
**The Chain:** An attacker uploads a malicious XSLT via the auth-bypass (CVE-2026-63219) and then triggers the Saxon engine to process that file by requesting a public record, resulting in code execution under the GeoNetwork process user.
## Exploitation
- **Status:** PoC available; no confirmed exploitation in the wild at the time of disclosure.
- **Complexity:** Low (Chaining the two flaws removes the requirement for high privileges).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full access to server data and environment variables)
- **Integrity:** High (Ability to modify geospatial metadata and server files)
- **Availability:** High (Potential for system shutdown or resource exhaustion)
## Remediation
### Patches
Update to the following versions released on July 8, 2026:
- **GeoNetwork 4.4.12**
- **GeoNetwork 4.2.17**
### Workarounds
Block write access to the vulnerable endpoint at the reverse proxy/WAF:
- **Apache httpd:** Deny `POST`, `PUT`, and `PATCH` requests to the `/geonetwork/srv/api/formatters` location.
- **Nginx:** Restrict the `/geonetwork/srv/api/formatters` location to only `GET`, `HEAD`, and `OPTIONS` methods.
## Detection
- **Indicators of Compromise:**
- Unexpected `.xsl` or `.zip` files appearing in the GeoNetwork formatters directory.
- Log entries showing `POST`, `PUT`, or `PATCH` requests to `/srv/api/formatters` from unauthorized or anonymous IP addresses.
- Outbound network connections or unusual child processes (e.g., `cmd.exe`, `/bin/sh`) spawned by the GeoNetwork Java process.
- **Detection Methods:** Monitor web server access logs for the specific API path and method combinations mentioned above.
## References
- **Vendor Advisory (Upload):** hxxps[://]github[.]com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42
- **Vendor Advisory (Saxon):** hxxps[://]github[.]com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r
- **Researcher Report:** hxxps[://]ethiack[.]com/info-hub/research/geonetwork-preauth-RCE