GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
GeoNetwork, a geospatial metadata catalog used in many government geoportals, has two vulnerabilities that can be chained to achieve unauthenticated remote code execution (RCE). The vulnerabilities stem from a missing authorization check and an unsafe Saxon XSLT processor configuration. The project released fixes in versions 4.4.12 and 4.2.17, and urged users to upgrade immediately. Initial fingerprinting identified 121 exposed instances across 39 countries, many of which are government-related.
GeoNetwork, a core component of many Spatial Data Infrastructure deployments across Europe and beyond, including the backend of the European INSPIRE geoportal, has been identified with two critical vulnerabilities. These flaws can be chained together to allow an unauthenticated attacker to execute arbitrary code on the server. The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31.
“An unauthenticated attacker can upload arbitrary .xsl or .zip formatter files to the server,” the project said in its advisory. The vulnerabilities are a missing authorization check on the formatter upload endpoint (CVE-2026-63219, CVSS score: 8.6) and an unsafe configuration of the Saxon Extensible Stylesheet Language Transformations (XSLT) processor (CVE-2026-58400, CVSS score: 9.1). The XSLT processor runs with secure processing enabled and Java extension functions disabled, allowing stylesheets to call `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` and execute operating-system commands as the GeoNetwork process user. The second flaw requires privileges to upload a formatter, which is why it is scored as needing high privileges. Chaining it with the upload flaw removes that precondition, because the upload is reachable without authentication.
Ethiack, a security vendor, fingerprinted 121 internet-exposed GeoNetwork deployments running affected versions across 39 countries, and reported that 89 percent of them were government-, military-, or national-agency-related. The disclosure follows a run of security issues across the wider geospatial stack, including a critical GeoServer flaw (CVE-2024-36401, CVSS score: 9.8) exploited into botnets and cryptocurrency miners, and a GeoServer XML External Entity (XXE) flaw added to CISA's KEV catalog in December 2025. Last month, a separate unauthenticated SQL injection to RCE in GeoServer was under active probing shortly after it went public.
Until the update is applied, administrators can block write methods to the formatter endpoint at the reverse proxy, thereby blocking legitimate formatter uploads through the admin console. The advisory lists the following interim rules:
- Apache httpd - deny POST, PUT, and PATCH requests to the /geonetwork/srv/api/formatters location.
- Nginx - restrict the same location to GET, HEAD, and OPTIONS methods.