GeoNetwork, a prominent open-source geospatial metadata catalog, recently addressed two severe security vulnerabilities that could allow unauthenticated remote code execution (RCE). These issues impact numerous government and agency geoportals worldwide, necessitating immediate attention from administrators.
Details of the Vulnerabilities
On July 8, 2026, GeoNetwork released critical updates in versions 4.4.12 and 4.2.17, with further details disclosed on August 31. These vulnerabilities, identified as CVE-2026-63219 and CVE-2026-58400, involve a missing authorization check and an unsafe configuration in the transformation engine, respectively.
The first flaw, CVE-2026-63219, scored at 8.6 on the CVSS scale, permits unauthorized file uploads to the formatter directory. This issue alone grants write access to server storage without authentication.
Exploitation and Impact
The second flaw, CVE-2026-58400, rated 9.1, involves the Saxon XSLT processor’s unsafe configuration that could execute operating system commands. Although this flaw requires high privileges, when combined with the first, it allows unauthenticated attackers to exploit the system fully.
According to Ethiopian security vendor Ethiack, whose researcher Rafael Castilho discovered these flaws, the vulnerability chain affects GeoNetwork versions starting from 4.0.6. Ethiack identified 121 vulnerable deployments in 39 countries, predominantly involving government and military entities.
Mitigation and Recommendations
GeoNetwork strongly advises upgrading to the patched versions 4.4.12 or 4.2.17 to ensure protection. Until upgrades are applied, administrators should restrict write methods to the formatter endpoint via the reverse proxy to prevent unauthorized uploads.
Interim security measures include configuring Apache httpd to deny POST, PUT, and PATCH requests and limiting Nginx to GET, HEAD, and OPTIONS methods at the /geonetwork/srv/api/formatters location.
The disclosure of these vulnerabilities follows a series of security challenges in the geospatial tech sphere, including past critical flaws in GeoServer that were actively exploited, highlighting the ongoing need for vigilance in geospatial cybersecurity.
Administrators should act promptly to apply these security measures and safeguard their systems against potential exploitation, ensuring the integrity and security of their geospatial data platforms.
