CVE-2026-46429: GeoNode has Unrestricted File Upload
Published Nov 6, 2026
·Updated
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.
Other sources
The upload service validation can be circumvented with specially crafted requests, allowing for the storage and serving of malicious files.
— GitHub
Affected Software
2 affected componentsFixes available
pip/geonode<=5.0.2
5.0.3
pip/geonode<5.0.3
5.0.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/GeoNodeto a version that resolves this vulnerability.Fixed in 5.0.3 - Upgrade
Upgrade
pip/geonodeto a version that resolves this vulnerability.Fixed in 5.0.3 - Upgrade
Upgrade
GeoNodeto a version that resolves this vulnerability.Fixed in 5.0.3
Event History
Nov 6, 2026
CVE Published
via MITRE·07:40 PM
Data Sourced
via MITRE·07:40 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·07:41 PM
Data Sourced
via GitHub·07:41 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness