GHSA-fqpv-mq26-pr4j: GeoNode has Unrestricted File Upload

Q: What does an attacker need to exploit this issue?

The attacker needs to be able to send specially crafted requests to the GeoNode upload service. Those requests can circumvent upload validation and cause malicious files to be stored and served.

Q: Who is exposed?

GeoNode deployments that expose the upload service are affected by the described validation bypass. The provided information does not state whether authentication or particular upload permissions are required.

Q: What can be done if patching is not immediately possible?

The provided information does not include a documented mitigation or workaround. Restricting access to the upload service may reduce exposure, but its effectiveness is not established by the advisory data.

Published Nov 6, 2026

Updated

The upload service validation can be circumvented with specially crafted requests, allowing for the storage and serving of malicious files.

Affected Software

2 affected componentsFixes available

pip/geonode<=5.0.2

5.0.3

pip/geonode<5.0.3

5.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/GeoNode to a version that resolves this vulnerability.
Fixed in 5.0.3
Upgrade
Upgrade pip/geonode to a version that resolves this vulnerability.
Fixed in 5.0.3

Event History

Nov 6, 2026

Advisory Published

via GitHub·07:41 PM

Data Sourced

via GitHub·07:41 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to be able to send specially crafted requests to the GeoNode upload service. Those requests can circumvent upload validation and cause malicious files to be stored and served.

Who is exposed?

GeoNode deployments that expose the upload service are affected by the described validation bypass. The provided information does not state whether authentication or particular upload permissions are required.

What can be done if patching is not immediately possible?

The provided information does not include a documented mitigation or workaround. Restricting access to the upload service may reduce exposure, but its effectiveness is not established by the advisory data.

GHSA-fqpv-mq26-pr4j: GeoNode has Unrestricted File Upload

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed?

What can be done if patching is not immediately possible?