Description

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-06T20:17:22.570Z",
  "pubdate": "2026-11-06T20:17:22.570Z",
  "executiveSummary": "GeoNode versions prior to 5.1.0 are susceptible to an OS Command Injection vulnerability arising from improper neutralization of user-supplied input during the vector file upload process.\nThe vulnerability allows a low-privileged remote attacker to execute arbitrary system-level commands with the privileges of the GeoNode application process.\nSuccessful exploitation facilitates unauthorized code execution, potential system compromise, and full administrative control over the underlying server environment.\nThe flaw stems from the insecure handling of vector file layer names, which are processed without sufficient sanitization or validation, allowing for the injection of shell metacharacters.\nThis represents a critical risk as it enables remote code execution (RCE) on the host infrastructure.\nThe attack is executable by authenticated users with low-privileged access, bypassing intended security boundaries through the application's geospatial data processing pipeline.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection, residing within the GeoNode geospatial data ingestion subsystem. The root cause is the unsafe concatenation or inclusion of user-provided vector file layer names directly into system-level shell commands during the file upload and processing workflow.\nWhen a user uploads a vector file, GeoNode parses the provided metadata, specifically the layer name attribute. If the application logic utilizes this name to invoke external geospatial processing utilities (such as GDAL/OGR or related shell-based tools) without proper parameterization or input filtering, an attacker can manipulate the input string.\nAn attacker can exploit this by crafting a layer name that incorporates shell metacharacters such as ';', '&&', or '|', followed by arbitrary OS commands. For instance, providing a layer name input formatted as 'original_name; [malicious_command]' forces the shell executing the processing task to interpret and execute the injected payload alongside the intended legitimate operation.\nThe attack flow follows a sequential process: First, the attacker initiates a vector file upload request through the authenticated interface. Second, the attacker intercepting or crafting the request modifies the metadata layer name field to include shell syntax. Third, the GeoNode backend receives this input and passes the unsanitized string into an execution context—likely a system() or popen() function call—that triggers the server-side command interpreter.\nBecause the execution occurs within the context of the web application's system user, the injected commands inherit all the permissions assigned to the GeoNode process. This facilitates post-exploitation activities including, but not limited to, unauthorized access to sensitive geospatial databases, exfiltration of configuration files, lateral movement within the network, or the deployment of persistent backdoors.\nThis vulnerability is present in all GeoNode versions prior to 5.1.0. It requires a low-privileged authentication session to the GeoNode instance, making the attack vector accessible to any internal or external actor with valid system credentials who has access to the data upload functionality. The lack of validation on the layer name parameter serves as the primary failure point, allowing malicious commands to break out of the intended application logic and interact directly with the operating system."
}