Description

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-03T18:17:22.997Z",
  "pubdate": "2026-09-03T18:17:22.997Z",
  "executiveSummary": "GeoNetwork versions prior to 4.4.12 and 4.2.17 contain a critical vulnerability involving an unprotected API endpoint designed for formatter file uploads.\nThe vulnerability is classified as an Unauthenticated Arbitrary File Upload, which grants remote, unauthenticated attackers the capability to inject arbitrary .xsl or .zip files directly into the application's formatter directory.\nThe primary impact is unauthorized write access to the server's file system, which poses severe risks to system integrity and potentially facilitates remote code execution depending on server-side processing of the uploaded files.\nThis vulnerability is particularly dangerous because it does not require prior authentication or privileged access, making it highly exploitable for any attacker with network access to the GeoNetwork instance.\nImmediate patching to the specified secure versions is required to mitigate the risk of unauthorized server-side modifications and potential persistence mechanisms established by an attacker.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper access control implementation within the GeoNetwork API endpoint responsible for managing formatter uploads. Specifically, the application fails to validate the identity of the user requesting the file upload operation, effectively bypassing authentication checks for this administrative function.\nThe vulnerable component is the API handler responsible for processing new formatter uploads, which allows users to transmit .xsl or .zip files without verification. By design, these formatters are stored in a dedicated directory on the server to be utilized by the application for data representation.\nAn attacker can exploit this flaw by sending a crafted HTTP request to the unprotected API endpoint. The request payload includes the malicious .xsl or .zip file. Because the application lacks path validation and authentication enforcement, it writes these files directly into the target directory on the server file system.\nThe exploitation flow proceeds as follows: First, the attacker identifies the exposed API endpoint used for formatter creation. Second, the attacker crafts a multipart/form-data request containing an arbitrary file. Third, the server accepts and persists the file, granting the attacker the ability to overwrite existing formatters or introduce new, unauthorized templates.\nThe impact of this unauthorized file upload is significant. Since the application explicitly permits the upload of formatter files, an attacker could potentially inject malicious code into XSL templates. If the application processes these templates in a way that executes embedded logic or scripts, it could lead to Remote Code Execution (RCE) on the underlying host. Furthermore, the ability to write arbitrary files provides a beachhead for an attacker to gain a foothold on the server, modify application behavior, or exfiltrate sensitive configuration information.\nThis vulnerability is present in all GeoNetwork versions prior to 4.4.12 and 4.2.17. It is reachable over the network and requires no credentials, making it a critical threat to any internet-facing or internally accessible GeoNetwork installation that has not been updated."
}