CVE-2026-63219
Unauthenticated file upload via missing authorization on formatter upload endpoint
CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
| CWE | CWE-862 |
| Vendor | geonetwork |
| Product | core-geonetwork |
| Published | Sep 3, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for geonetwork core-geonetwork
Be the first to know when new high vulnerabilities affecting geonetwork core-geonetwork are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
geonetwork / core-geonetwork
>= 4.3.0, < 4.4.12 < 4.2.17
References
github.com: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42 github.com: https://github.com/geonetwork/core-geonetwork/pull/9346 docs.geonetwork-opensource.org: https://docs.geonetwork-opensource.org/4.2/overview/change-log/version-4.2.17 docs.geonetwork-opensource.org: https://docs.geonetwork-opensource.org/4.4/overview/change-log/version-4.4.12 thehackernews.com: https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html