Description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke
`java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
Published: 2026-09-03
Score: 9.1 Critical
EPSS: 1.2% Low
KEV: No
Impact: Remote Code Execution
Action: Patch
AI Analysis

Impact

GeoNetwork uses the Saxon XSLT processor to render formatters but applies it without secure processing and leaves Java extensions enabled. A malicious formatter written in XSLT can invoke Java’s runtime execution APIs, allowing an attacker to run arbitrary OS commands with the privileges of the GeoNetwork process. The vulnerability thus permits remote code execution as a high‑severity flaw.

Affected Systems

The issue affects the GeoNetwork catalog application before version 4.4.12 and 4.2.17. Any deployment of these older GeoNetwork releases, regardless of operating system, is susceptible to the flaw.

Risk and Exploitability

The CVSS score is 9.1, indicating a critical impact. The EPSS score is 1%, indicating a low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an authenticated user who can upload a formatter; thus, the flaw can be used by a privileged user through the web interface to deliver a malicious .xsl file and trigger remote code execution.

Generated by OpenCVE AI on September 4, 2026 at 14:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest GeoNetwork release (4.4.12 or newer, or 4.2.17 or newer) to eliminate the insecure XSLT configuration.
  • If an immediate upgrade is not possible, revoke formatter upload permissions from all users except trusted administrators and delete any existing custom formatter files that could contain malicious XSLT.
  • Configure the Saxon processor to enable secure processing and disable Java extension functions to prevent the execution of arbitrary Java code via XSLT.

Generated by OpenCVE AI on September 4, 2026 at 14:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Geonetwork
Geonetwork geonetwork
Vendors & Products Geonetwork
Geonetwork geonetwork

Fri, 04 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
Title GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
Weaknesses CWE-470
CWE-94
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Geonetwork Geonetwork
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-04T13:42:08.271Z

Reserved: 2026-06-30T18:19:58.378Z

Link: CVE-2026-58400

cve-icon Vulnrichment

Updated: 2026-09-03T17:50:12.749Z

cve-icon NVD

Status : Deferred

Published: 2026-09-03T18:17:22.827

Modified: 2026-09-09T21:09:13.080

Link: CVE-2026-58400

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T15:15:14Z

Weaknesses
  • CWE-470

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')