Auth bypass in Geonetwork Core-Geonetwork
CVE-2026-63219
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (38.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Geonetwork Core-Geonetwork — versions < 4.2.17, >= 4.3.0, < 4.4.12
Weakness classification (CWE)
References
- docs.geonetwork-opensource.org/4.2/overview/change-log/version-4.2.17
- docs.geonetwork-opensource.org/4.4/overview/change-log/version-4.4.12
- github.com/geonetwork/core-geonetwork/pull/9346
- github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42
- thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html
Frequently asked questions
- What is CVE-2026-63219?
- CVE-2026-63219 is a high-severity vulnerability in Geonetwork Core-Geonetwork, classified under Missing Authorization. CVSS score: 8.6/10. Published 2026-09-03.
- How severe is CVE-2026-63219?
- High severity. CVSS v3 base score is 8.6 out of 10.