Ethical Hacking News
GeoNetwork, a widely used open-source geospatial metadata catalog, has been identified as the target of a critical unauthenticated remote code execution (RCE) chain vulnerability. This vulnerability, which was discovered by security researcher Rafael Castilho and disclosed by security vendor Ethiack, has significant implications for government geoportals and organizations that rely on GeoNetwork for their spatial data infrastructure needs. The vulnerability chain exploits a combination of two vulnerabilities, and all versions of GeoNetwork up to and including 4.4.11 and 4.2.16 are affected. Users are strongly encouraged to upgrade to the latest versions as soon as possible to prevent exploitation of the vulnerability.
GeoNetwork has a critical unauthenticated remote code execution (RCE) chain vulnerability. The vulnerability exploits two flaws: missing authorization check and unsafe configuration of Saxon XSLT processor. The chain is reachable starting with version 4.0.6 and affects 121 internet-exposed deployments in 39 countries. GeoNetwork has shipped fixes in versions 4.4.12 and 4.2.17, and recommends upgrading as soon as possible. Administrators can block write methods to the formatter endpoint to prevent exploitation.
GeoNetwork, an open-source geospatial metadata catalog, has recently been identified as the target of a critical unauthenticated remote code execution (RCE) chain vulnerability. This vulnerability, which was discovered by security researcher Rafael Castilho and disclosed by security vendor Ethiack, has significant implications for government geoportals and organizations that rely on GeoNetwork for their spatial data infrastructure needs.
According to the vulnerability report, the RCE chain exploits a combination of two vulnerabilities: a missing authorization check on the formatter upload endpoint and an unsafe configuration of the Saxon Extensible Stylesheet Language Transformations (XSLT) processor. The first flaw, CVE-2026-63219, allows an anonymous user to upload arbitrary .xsl or .zip formatter files to the GeoNetwork formatter directory, granting unauthorized write access to server storage. The second flaw, CVE-2026-58400, is an unsafe configuration of the Saxon XSLT processor, which enables the execution of operating-system commands as the GeoNetwork process user.
The vulnerability chain is as follows: an attacker uploads a malicious formatter through the unprotected endpoint, triggers a follow-up GET request to a public record, and then executes the stylesheet, which delivers code execution. Security vendor Ethiack reported that the chain is reachable starting with version 4.0.6, when the formatter endpoint was refactored, and the authorization line was dropped.
Ethiack also reported that 121 internet-exposed GeoNetwork deployments, running affected versions across 39 countries, were fingerprinted, and 89 percent of them were government-, military-, or national-agency-related. This highlights the widespread impact of the vulnerability, which affects all 4.4.x releases up to and including 4.4.11 and all 4.2.x releases up to and including 4.2.16.
In response to the vulnerability, GeoNetwork has shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026. It is recommended that all users upgrade to these versions as soon as possible to prevent exploitation of the vulnerability. In the meantime, administrators can block write methods to the formatter endpoint at the reverse proxy, thereby blocking legitimate formatter uploads through the admin console.
The vulnerabilities were discovered and disclosed by security researcher Rafael Castilho and security vendor Ethiack, respectively. The disclosure of this vulnerability highlights the importance of ongoing vulnerability testing and security monitoring for organizations that rely on GeoNetwork for their spatial data infrastructure needs.
Related Information:
https://www.ethicalhackingnews.com/articles/GeoNetwork-Unauthenticated-RCE-Chain-A-Critical-Vulnerability-in-Government-Geoportals-ehn.shtml
https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html
https://nvd.nist.gov/vuln/detail/CVE-2026-63219
https://www.cvedetails.com/cve/CVE-2026-63219/
https://nvd.nist.gov/vuln/detail/CVE-2026-58400
https://www.cvedetails.com/cve/CVE-2026-58400/
Published: Wed Sep 2 05:32:59 2026 by llama3.2 3B Q4_K_M
