GeoNetwork patches XSS, code injection, upload flaws
OpenGeo fixed three vulnerabilities in GeoNetwork—reflected XSS, unauthenticated file upload, and unsafe XSLT processing—that can lead to server compromise; patch to 4.4.12 or 4.2.17.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2026-57582 (templated); no exploitation in the wild is recorded.
NCSC-NL issued an advisory covering three vulnerabilities in GeoNetwork, an open-source metadata catalogue application, affecting versions 4.4.5 through 4.4.11 and all versions prior to 4.4.12 and 4.2.17. The most severe issue (CVE-2026-58400, CVSS 9.1) is an unprotected API endpoint that allows unauthenticated attackers to upload arbitrary .xsl or .zip files, granting unauthorized write access to the server and potentially leading to full server compromise. A second flaw (CVE-2026-63219, CVSS 8.6) stems from an insecure XSLT processor configuration that lets users with upload permissions execute arbitrary OS commands via uploaded .xsl files—an unsafe reflection/code injection issue. The third (CVE-2026-57582, CVSS 8.2) is a reflected XSS in the public, unauthenticated catalogue search function caused by insufficient sanitization of the uiconfig query parameter, allowing attackers to inject and execute JavaScript in victims' browser sessions.
No exploitation in the wild is reported; this is a coordinated disclosure with vendor patches already available. OpenGeo has released GeoNetwork 4.4.12 and 4.2.17 to remediate all three issues. Defenders running GeoNetwork should prioritize patching given the unauthenticated upload path, and review file upload logs and API access to the affected endpoint for signs of unauthorized .xsl/.zip uploads, and check for anomalous outbound requests or command execution originating from the GeoNetwork server process.
Mentioned in this report
Detection guidance
GeoNetwork XSLT Processor Command Execution via Uploaded XSL File
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects suspicious child process execution (cmd.exe, bash, powershell) spawned by GeoNetwork Java process following .xsl file ingestion, indicative of XSLT code injection (CVE-2026-63219). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GeoNetwork XSLT Processor Command Execution via Uploaded XSL File
description: Detects GeoNetwork Java process spawning shell interpreters (cmd.exe,
bash, powershell.exe, sh) following .xsl file upload or processing, indicating unsafe
XSLT template evaluation. CVE-2026-63219 allows OS command execution via malicious
.xsl payloads processed by the XSLT engine.
tags:
- attack.t1059.001
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: java
ParentCommandLine|contains:
- geonetwork
- GeoNetwork
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \bash.exe
- \sh.exe
filter_legitimate:
CommandLine|contains:
- Microsoft Visual Studio
- Java build tool
condition: selection_parent and selection_child and not filter_legitimate
falsepositives:
- Legitimate GeoNetwork administrative tasks that invoke system commands for file
management
- GeoNetwork plugins or extensions that spawn subprocesses for authorized operations
level: high
id: 3e526a3b-c8c5-507a-aaf1-1c2dac96d24c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0343.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs