CVE-2026-63219: Unauthenticated file upload via missing authorization on formatter upload endpoint
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary .xsl or .zip formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GeoNetworkto a version that resolves this vulnerability.Fixed in 4.4.12 - Upgrade
Upgrade
GeoNetworkto a version that resolves this vulnerability.Fixed in 4.2.17
Event History
Frequently Asked Questions
Which deployments are affected?
GeoNetwork deployments running versions earlier than 4.4.12 or 4.2.17 are affected, provided the formatter upload API endpoint is reachable by an attacker.
Does exploitation require an account or user interaction?
No. The vulnerable endpoint lacks authorization, so an unauthenticated attacker can upload formatter files without credentials or user interaction.
What can an attacker upload?
An attacker can upload arbitrary .xsl or .zip formatter files and write arbitrary files into the GeoNetwork formatter directory. The described impact is unauthorized write access to server storage.
How can this be remediated?
Upgrade GeoNetwork to version 4.4.12 or 4.2.17. These versions include the patch for the unprotected formatter upload endpoint.