Two Flaws, One Unauthenticated RCE
Researchers have disclosed a chainable pair of vulnerabilities in GeoNetwork, the open-source geospatial metadata catalog that underpins spatial data infrastructure and geoportal backends for government agencies worldwide, including deployments tied to Europe's INSPIRE directive. Chained together, the two flaws let an attacker with no credentials at all achieve remote code execution on the server.
The Vulnerability Chain
| CVE | CVSS | Root Cause |
|---|---|---|
| CVE-2026-63219 | 8.6 | Missing authorization check on the formatter upload endpoint, allowing unauthenticated upload of arbitrary .xsl or .zip formatter files |
| CVE-2026-58400 | 9.1 | Unsafe Saxon XSLT processor configuration that permits stylesheets to invoke java.lang.Runtime.exec() or java.lang.ProcessBuilder for OS command execution |
The two bugs compound each other. CVE-2026-63219 strips the authentication requirement needed to plant a malicious formatter file on the server. An attacker then triggers the Saxon XSLT engine through a normal, public record GET request, which executes the embedded command under the GeoNetwork process account — no login required at any stage of the chain.
Affected & Fixed Versions
- Affected: all 4.4.x releases up to 4.4.11, and all 4.2.x releases up to 4.2.16
- Fixed: 4.4.12 and 4.2.17, released July 8, 2026
Security vendor Ethiack, credited with the discovery via researcher Rafael Castilho, published its advisory on August 31, 2026 after coordinating with the GeoNetwork project. Ethiack's internet-wide fingerprinting identified 121 exposed GeoNetwork deployments across 39 countries, and found that 89% belonged to government or military-related entities — making this one of the more consequential unauthenticated RCE disclosures affecting public-sector infrastructure this year.
Mitigation
Organizations that cannot patch immediately should block POST, PUT, and PATCH requests to /geonetwork/srv/api/formatters at the reverse proxy layer (Apache httpd or Nginx rules are provided in the GeoNetwork advisory) as a stopgap. This closes the unauthenticated upload path that the chain depends on, though upgrading to 4.4.12 or 4.2.17 remains the only complete fix.
Why It Matters
Geoportals built on GeoNetwork frequently sit at the edge of government network perimeters, cataloging everything from land-use records to infrastructure mapping data. An unauthenticated RCE against a system with that footprint — and that concentration of government exposure — is a reminder that metadata catalogs and document-processing pipelines are not low-value targets; XSLT and similar transform engines are a recurring source of server-side code execution when they're allowed to reach outside their sandbox.