CVE-2026-33050: GeoNode has OS command injection via uploaded file layer name

Q: Who can exploit this issue?

A remote user with low privileges can exploit it by uploading a vector file whose layer name contains crafted shell syntax. The issue affects GeoNode instances prior to version 5.1.0.

Q: What access or interaction is required for exploitation?

The attacker needs the ability to upload a vector file to the GeoNode instance. No further user interaction is described.

Q: What is the impact if exploitation succeeds?

Successful exploitation allows execution of arbitrary operating-system commands on the GeoNode server.

Q: What should administrators do?

Upgrade GeoNode to version 5.1.0, which fixes the issue. If an immediate upgrade is not possible, restrict vector-file upload capability to trusted users.

Published Nov 6, 2026

Updated

Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name.

Other sources

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.

— MITRE

Affected Software

2 affected componentsFixes available

pip/geonode<5.1.0

5.1.0

pip/geonode<5.1.0

5.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/GeoNode to a version that resolves this vulnerability.
Fixed in 5.1.0
Upgrade
Upgrade pip/geonode to a version that resolves this vulnerability.
Fixed in 5.1.0
Upgrade
Upgrade GeoNode to a version that resolves this vulnerability.
Fixed in 5.1.0

Event History

Nov 6, 2026

CVE Published

via MITRE·07:39 PM

Data Sourced

via MITRE·07:39 PM

DescriptionSeverityWeakness

Advisory Published

via GitHub·07:39 PM

Data Sourced

via GitHub·07:39 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote user with low privileges can exploit it by uploading a vector file whose layer name contains crafted shell syntax. The issue affects GeoNode instances prior to version 5.1.0.

What access or interaction is required for exploitation?

The attacker needs the ability to upload a vector file to the GeoNode instance. No further user interaction is described.

What is the impact if exploitation succeeds?

Successful exploitation allows execution of arbitrary operating-system commands on the GeoNode server.

What should administrators do?

Upgrade GeoNode to version 5.1.0, which fixes the issue. If an immediate upgrade is not possible, restrict vector-file upload capability to trusted users.

CVE-2026-33050: GeoNode has OS command injection via uploaded file layer name

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or interaction is required for exploitation?

What is the impact if exploitation succeeds?

What should administrators do?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or interaction is required for exploitation?

What is the impact if exploitation succeeds?

What should administrators do?