GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
Two chained vulnerabilities in GeoNetwork (CVE-2026-63219 and CVE-2026-58400) enable unauthenticated remote code execution on geospatial metadata servers behind many government geoportals CVE-2026-63219 (CVSS 8.6) is a missing authorization check on the formatter upload endpoint, allowing anonymous users to write arbitrary .xsl or .zip files CVE-2026-58400 (CVSS 9.1) is an unsafe Saxon XSLT processor configuration that permits Java extension function calls like Runtime.exec() despite secure proc
Analysis
TL;DR
- Two chained vulnerabilities in GeoNetwork (CVE-2026-63219 and CVE-2026-58400) enable unauthenticated remote code execution on geospatial metadata servers behind many government geoportals
- CVE-2026-63219 (CVSS 8.6) is a missing authorization check on the formatter upload endpoint, allowing anonymous users to write arbitrary .xsl or .zip files
- CVE-2026-58400 (CVSS 9.1) is an unsafe Saxon XSLT processor configuration that permits Java extension function calls like Runtime.exec() despite secure processing being enabled
- Fixes shipped in versions 4.4.12 and 4.2.17 on July 8, 2026, with vulnerability details published on August 31, 2026
- Ethiack fingerprinted 121 internet-exposed affected deployments across 39 countries, 89% of which were government, military, or national agency systems
Why It Matters
This vulnerability chain directly impacts critical geospatial infrastructure used by governments worldwide, including the European INSPIRE geoportal, making it a high-priority concern for public sector AI and data infrastructure operators. The combination of an unauthenticated upload flaw with an unsafe transformation engine demonstrates how seemingly minor authorization gaps can cascade into full remote code execution in open-source geospatial stacks.
Technical Details
- CVE-2026-63219 (CVSS 8.6): Missing authorization check on the
/geonetwork/srv/api/formattersendpoint introduced during a 4.0.6 refactor that dropped the authorization line, allowing unauthenticated POST/PUT/PATCH requests to upload arbitrary .xsl or .zip formatter files - CVE-2026-58400 (CVSS 9.1): Saxon XSLT processor configured with secure processing enabled but Java extension functions disabled yet still allowing stylesheets to invoke
java.lang.Runtime.exec()andjava.lang.ProcessBuilder, enabling OS command execution as the GeoNetwork process user - Exploitation chain: An attacker uploads a malicious formatter via the unprotected endpoint, then triggers execution with a GET request to any public record, which causes the Saxon engine to process the uploaded stylesheet
- Affected versions: All 4.4.x releases through 4.4.11 and all 4.2.x releases through 4.2.16; fixed in 4.4.12 and 4.2.17
- Interim mitigation: Block write methods (POST, PUT, PATCH) to
/geonetwork/srv/api/formattersat the reverse proxy level using Apache deny rules or Nginx method restrictions
Industry Insight
- Organizations operating GeoNetwork-based geoportals should prioritize immediate upgrading to patched versions, especially given the high concentration of government and military deployments among exposed instances
- The pattern of recurring critical vulnerabilities in the geospatial stack (GeoServer and GeoNetwork) suggests a need for more rigorous security auditing and secure-by-default configurations in open-source geospatial projects
- The eight-week gap between the fix and public disclosure raises questions about responsible disclosure timelines for infrastructure-critical open-source projects serving government agencies
Disclaimer: The above content is generated by AI and is for reference only.