GeoNetwork Unauth RCE Chain: CVE-2026-6219 & CVE-2026-5840

Summary of GeoNetwork Unauthenticated RCE Chain Vulnerability Vulnerability Overview GeoNetwork (an open-source geospatial metadata catalog serving government and agency deployments) contains two vulnerabilities that can be chained to achieve Unauthenticated Remote Code Execution (RCE): 1. Unauthenticated File Upload Vulnerability (CVE-2026-6219, CVSS 8.6): The formatter upload endpoint lacks an authorization check, allowing anonymous users to upload arbitrary or files to the formatter directory, thereby obtaining unauthenticated write access on the server. 2. Insecure Saxon XSLT Processor Configuration (CVE-2026-5840, CVSS 9.1): The Saxon engine runs in a mode with secure processing enabled and Java extension functions disabled, yet the stylesheet can still invoke or to execute operating system commands. Attack Chain: The attacker first uploads a malicious formatter via the unprotected endpoint, then triggers the Saxon engine to execute the stylesheet via a publicly documented GET request, resulting in the execution of arbitrary code. Impact Scope Affected versions: Up to and including 4.4.11 in the 4.4.x series, and up to and including 4.2.16 in the 4.2.x series. Fixed versions: 4.4.12 and 4.2.17 (released on August 7, 2026). Vulnerability details were made public on August 31, 2026. This vulnerability originates from the OSGeo project, maintained by the United Nations Food and Agriculture Organization (FAO), and is a core component of numerous government deployments, including the European INSPIRE geoportals. Researchers identified 121 internet-exposed GeoNetwork deployments running affected versions, distributed across 39 countries, of which 89 are associated with government, military, or institutional entities. Starting from version 4.0.6, the authorization checks were removed following a refactoring of the formatter endpoint, enabling uploads to be reached without authentication. Remediation Upgrade: Upgrade to 4.4.12 or 4.2.17 as soon as possible. Interim Mitigations (prior to upgrade): - Block write methods to the formatter endpoint on the reverse proxy: - Apache httpd: - Nginx: This vulnerability has no reference in GeoNetwork’s CISA Known Exploited Vulnerabilities catalog; there are no public reports of exploitation in the wild. POC / Exploit Code The page does not include specific POC code or code blocks for the exploit; it only describes the attack chain in text (uploading / → triggering Saxon execution via GET, which calls / ).

Goal Reached Thanks to every supporter — we hit 100%!

GeoNetwork Unauth RCE Chain: CVE-2026-6219 & CVE-2026-5840