Two security flaws in GeoNetwork, an open-source geospatial metadata catalog, can be combined to let attackers execute code remotely without authentication on systems that power government and agency geoportals worldwide. The project released patches in versions 4.4.12 and 4.2.17 on July 8, 2026, and made the vulnerability details public on August 31. GeoNetwork was created at the United Nations Food and Agriculture Organization and is now maintained under the Open Source Geospatial Foundation, serving as a core component of many Spatial Data Infrastructure deployments across Europe and beyond, including the backend of the European INSPIRE geoportal.
The exploit chain pairs a missing authorization check with an unsafe transformation engine. The first vulnerability, CVE-2026-63219 with a CVSS score of 8.6, is a missing authorization check on the formatter upload endpoint that lets anonymous users write arbitrary .xsl or .zip formatter files to the GeoNetwork formatter directory. The second flaw, CVE-2026-58400 with a CVSS score of 9.1, is an unsafe configuration of the Saxon XSLT processor used to render formatters, which runs with secure processing enabled and Java extension functions disabled, allowing any stylesheet it loads to call java.lang.Runtime.exec() or java.lang.ProcessBuilder and run operating-system commands as the GeoNetwork process user. All 4.4.x releases through 4.4.11 and all 4.2.x releases through 4.2.16 are affected. Security vendor Ethiack, whose researcher Rafael Castilho reported the flaws, fingerprinted 121 internet-exposed GeoNetwork deployments running affected versions across 39 countries, with 89 percent linked to government, military, or national agency operations.
The project said an unauthenticated attacker can upload arbitrary .xsl or .zip formatter files to the server through the unprotected endpoint. According to the report, the chain became exploitable starting with version 4.0.6, when the formatter endpoint was refactored and the authorization line was dropped. An attacker first uploads a malicious formatter through the unprotected endpoint, then a follow-up GET request to a public record triggers the Saxon engine to execute the stylesheet, delivering code execution. The project urged all users to upgrade to 4.4.12 or 4.2.17 as soon as possible.
The vulnerability exists because the second flaw on its own requires privileges to upload a formatter, which is why it's scored as needing high privileges, but chaining it with the upload flaw removes that precondition since the upload is reachable without authentication. Until the update is applied, administrators can block write methods to the formatter endpoint at the reverse proxy, thereby blocking legitimate formatter uploads through the admin console—Apache httpd users can deny POST, PUT, and PATCH requests to the /geonetwork/srv/api/formatters location, while Nginx users can restrict the same location to GET, HEAD, and OPTIONS methods. The disclosure follows a run of security issues across the wider geospatial stack, including a critical GeoServer flaw last year that was exploited into botnets and cryptocurrency miners, a GeoServer XXE flaw added to CISA's Known Exploited Vulnerabilities catalog in December 2025 after evidence of active exploitation, and last month, a separate unauthenticated SQL injection to RCE in GeoServer that came under active probing shortly after it went public.
The flaws were patched roughly eight weeks before the advisories were published, and as of the disclosure, no reference to the GeoNetwork flaws appeared in CISA's Known Exploited Vulnerabilities catalog, with no public reporting of exploitation in the wild. The roughly two-month gap between patch and public disclosure gave administrators a window to update before attackers could widely weaponize the chain, though the 121 exposed deployments identified by Ethiack suggest many systems remain at risk. Organizations running geospatial infrastructure face a strategic choice between the operational complexity of frequent patching and the exposure that comes with delay, particularly when critical government services depend on these platforms.