CVE-2026-58400 Details
Description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
A remote code execution vulnerability has been identified in GeoNetwork versions through 4.4.11 and 4.2.16. The issue arises because the Saxon XSLT processor, used for rendering formatters, is set up without secure processing and allows Java extension functions. This misconfiguration enables any uploaded stylesheet to execute arbitrary operating system commands as the GeoNetwork process user. The vulnerability can be exploited by users with sufficient privileges to upload formatters, by including malicious Java extension calls in the uploaded XSL files.
Users are advised to update GeoNetwork to version 4.4.12 or 4.2.17. Until the update is applied, administrators can block write methods to the formatter endpoint at the reverse proxy, denying POST, PUT, and PATCH requests to the GeoNetwork API formatters location.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.geonetwork-opensource.org/4.2/overview/change-log/version-4.2.17 | [email protected] | Release NotesVendor |
| https://docs.geonetwork-opensource.org/4.4/overview/change-log/version-4.4.12 | [email protected] | Release NotesVendor |
| https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r | [email protected] | AdvisoryRemedyVendor |
| https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GeoNetwork | <= 4.4.11 (semver) <= 4.2.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |