CVE-2026-39921: GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the docurl parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GeoNodeto a version that resolves this vulnerability.Fixed in 4.4.5 - Upgrade
Upgrade
GeoNodeto a version that resolves this vulnerability.Fixed in 5.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39921?
CVE-2026-39921 has a medium severity due to the potential for server-side request forgery that can affect the confidentiality of the system.
How do I fix CVE-2026-39921?
To fix CVE-2026-39921, upgrade GeoNode to versions 4.4.5 or 5.0.2 or higher.
Who is affected by CVE-2026-39921?
CVE-2026-39921 affects GeoNode users with document upload permissions running versions prior to 4.4.5 and 5.0.2.
What type of vulnerability is CVE-2026-39921?
CVE-2026-39921 is classified as a server-side request forgery (SSRF) vulnerability.
Can unauthenticated users exploit CVE-2026-39921?
No, only authenticated users with document upload permissions can exploit CVE-2026-39921.