Skip to content
OpenAdvisories

Vendor

geonetwork

8 known vulnerabilities.

Products

core-geonetwork 7 GeoNetwork 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.1
    CVE-2026-39379

    GeoNetwork: Reflected XSS through client-side template injection

    GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS a…

    geonetwork core-geonetwork org.geonetwork-opensource:geonetwork Maven
  • High 7.5
    CVE-2026-46487

    GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field

    GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query fi…

    geonetwork core-geonetwork org.geonetwork-opensource:geonetwork Maven
  • High 7.8
    CVE-2026-55864 Scanner template

    GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

    GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attac…

    geonetwork core-geonetwork org.geonetwork-opensource:gn-web-app Maven
  • High 8.6
    CVE-2026-63219 Exploited

    Unauthenticated file upload via missing authorization on formatter upload endpoint

    GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenti…

    geonetwork core-geonetwork