Security researchers discovered two vulnerabilities in the GeoNetwork geospatial metadata catalog that allow unauthenticated attackers to achieve remote code execution by chaining file uploads with unsafe processing.

Key Points

• The vulnerability chain affects GeoNetwork versions 4.0.6 through 4.4.11 and 4.2.16, with patches released in versions 4.4.12 and 4.2.17.
• CVE-2026-63219 involves a missing authorization check on the formatter upload endpoint, while CVE-2026-58400 exploits an unsafe configuration in the Saxon XSLT processor.
• Security firm Ethiack identified 121 internet-exposed instances across 39 countries, noting that 89 percent are associated with government, military, or national agencies.
• Administrators can mitigate the risk by configuring reverse proxies to block POST, PUT, and PATCH requests to the /geonetwork/srv/api/formatters endpoint.
• The flaws were reported by researcher Rafael Castilho and fixed by the Open Source Geospatial Foundation (OSGeo) on July 8, 2026.

Why it Matters

GeoNetwork is a critical component of global Spatial Data Infrastructure, and these vulnerabilities pose a significant risk to government and military geoportals that manage sensitive geographic data. Because the exploit chain allows for unauthenticated remote code execution, immediate patching is essential to prevent potential unauthorized access to infrastructure backends.