The vulnerability allows any unauthenticated user to upload arbitrary .xsl or .zip files to GeoNetwork’s formatter upload endpoint, enabling them to write files directly into the formatter directory. This lack of authorization (CWE-862) permits an attacker to add or overwrite stored files, thereby compromising data integrity and potentially the application’s behavior. The description does not state that code execution is guaranteed, but the ability to place arbitrary files could be leveraged in subsequent attacks if those files are executable or modify critical configuration.

Any GeoNetwork instance running a version older than 4.4.12 or 4.2.17 is vulnerable. This includes deployments of geonetwork:core-geonetwork before those releases.

With a CVSS score of 8.6 the vulnerability is high risk. It is not listed in the CISA KEV catalog. The lack of authentication allows an attacker to submit a request to the /formatter/upload endpoint; the likely attack vector is an unauthenticated HTTP request containing a file payload. Given the severity and the ease of exploitation, immediate action is recommended.