GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
- ID
- 20606
- Status
- summarized
- Published
- 02 Sep 2026, 5:18 PM
- Fetched
- 02 Sep 2026, 5:57 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 02 Sep 2026, 6:06 PM
- Tags
- Audience
- developers
What happened
GeoNetwork, an open-source geospatial metadata catalog used by many government geoportals, patched an unauthenticated RCE chain (CVE-2026-63219, CVSS 8.6 + CVE-2026-58400, CVSS 9.1) in versions 4.4.12 and 4.2.17 on July 8, 2026. The chain combines a missing authorization check on the formatter upload endpoint with an unsafe Saxon XSLT processor configuration that allows arbitrary OS command execution. The flaw is reachable from version 4.0.6 onward and was reported by Ethiack researcher Rafael Castilho.
Why it matters
If you operate or depend on a GeoNetwork deployment at or below 4.4.11 / 4.2.16, patch immediately to 4.4.12 or 4.2.17 — an anonymous attacker can upload a malicious XSL formatter and trigger RCE via a single GET request. For builders not running GeoNetwork, there is no direct action; this is a niche geospatial infrastructure issue.
Discussion angle
Worth a 30-second mention only if anyone in the community ships or integrates with government geoportals; otherwise skip. The more broadly useful lesson is the XSLT-as-RCE-vector pattern — Saxon's 'secure processing' mode still permits java.lang.Runtime.exec() via stylesheet execution, which is a recurring footgun in any Java stack that processes user-supplied XSLT.