GeoNetwork Vulnerability Chain Enables Unauthenticated RCE on Government Geoportals
Two chained vulnerabilities in GeoNetwork, an open-source geospatial metadata catalog, allow unauthenticated remote code execution, impacting government geoportals.
Two critical vulnerabilities in the GeoNetwork open-source geospatial metadata catalog have been chained together to enable unauthenticated remote code execution (RCE). This software is a foundational component for numerous government and agency geoportals, making the discovery a significant concern for public sector data infrastructure.
The GeoNetwork project, which originated at the United Nations Food and Agriculture Organization and is now maintained under the Open Source Geospatial Foundation (OSGeo), is widely deployed. It serves as the backend for critical systems like the European INSPIRE geoportal, underscoring the potential impact of these flaws.
The vulnerability chain leverages CVE-2026-63219, a missing authorization check on the formatter upload endpoint, and CVE-2026-58400, an unsafe configuration within the Saxon Extensible Stylesheet Language Transformations (XSLT) processor. The first flaw allows an unauthenticated attacker to upload arbitrary .xsl or .zip formatter files to the GeoNetwork formatter directory, granting unauthorized write access to server storage.
While the upload flaw alone represents a significant security weakness, its true danger is realized when chained with the second vulnerability. CVE-2026-58400 involves an unsafe configuration of the Saxon XSLT processor, which, despite running with secure processing enabled and Java extensions disabled, can still be tricked into executing operating system commands via the java.lang.Runtime.exec() or java.lang.ProcessBuilder methods.
Normally, exploiting the XSLT processor requires privileges to upload a formatter. However, by first exploiting the unauthenticated file upload vulnerability (CVE-2026-63219), an attacker can bypass this precondition. A subsequent GET request to a public record then triggers the Saxon engine to process the maliciously uploaded stylesheet, leading to code execution as the GeoNetwork process user.
Security vendor Ethiack, which reported the vulnerabilities, identified 121 internet-exposed GeoNetwork deployments running affected versions across 39 countries. A significant majority, 89%, were linked to government, military, or national agencies. These figures represent exposed instances, not confirmed compromises.
The vulnerabilities affect GeoNetwork versions 4.0.6 up to and including 4.4.11 for the 4.4.x branch, and up to and including 4.2.16 for the 4.2.x branch. Patches were released on July 8, 2026, in versions 4.4.12 and 4.2.17, with vulnerability details published on August 31, 2026.
Until systems can be updated, administrators can mitigate the risk by blocking write methods (POST, PUT, PATCH) to the /geonetwork/srv/api/formatters endpoint at their reverse proxy. This measure prevents both malicious uploads and legitimate administrative formatter uploads. The disclosure follows a series of recent security issues impacting the geospatial technology stack, including critical vulnerabilities in GeoServer.