GeoNode versions 4.0 up to 4.4.4 and 5.0 up to 5.0.1 contain a server‑side request forgery flaw in the document upload feature. An authenticated user with upload permissions can supply a malicious URL via the doc_url parameter, causing the server to perform an HTTP request to any address supplied, including internal network targets, loopback, RFC1918 addresses, or cloud metadata services. The vulnerability permits information disclosure and could be used to mount further attacks against internal services. The weakness is classified as CWE‑918.

The affected product is GeoNode, released in two main series: version 4.x (from 4.0 through 4.4.4) and version 5.x (from 5.0 through 5.0.1). All earlier releases in these ranges are vulnerable until a patch is applied.

The CVSS score of 5.3 indicates medium severity. Exploitation requires the attacker to be an authenticated user with document upload rights; there is no mention of privilege escalation or external access. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is unlikely but not impossible. Because the affected systems can reach internal network resources, the risk to the internal network is moderate, warranting prompt attention.