GeoNetwork patches XSS, code injection, upload flaws
OpenGeo fixed three vulnerabilities in GeoNetwork—reflected XSS, unauthenticated file upload, and unsafe XSLT processing—that can lead to server compromise; patch to 4.4.12 or 4.2.17.
NCSC-NL issued an advisory covering three vulnerabilities in GeoNetwork, an open-source metadata catalogue application, affecting versions 4.4.5 through 4.4.11 and all versions prior to 4.4.12 and 4.2.17. The most severe issue (CVE-2026-58400, CVSS 9.1) is an unprotected API endpoint that allows unauthenticated attackers to upload arbitrary .xsl or .zip files, granting unauthorized write access to the server and potentially leading to full server compromise. A second flaw (CVE-2026-63219, CVSS 8.6) stems from an insecure XSLT processor configuration that lets users with upload permissions execute arbitrary OS commands via uploaded .xsl files—an unsafe reflection/code injection issue. The third (CVE-2026-57582, CVSS 8.2) is a reflected XSS in the public, unauthenticated catalogue search function caused by insufficient sanitization of the uiconfig query parameter, allowing attackers to inject and execute JavaScript in victims' browser sessions.
No exploitation in the wild is reported; this is a coordinated disclosure with vendor patches already available. OpenGeo has released GeoNetwork 4.4.12 and 4.2.17 to remediate all three issues. Defenders running GeoNetwork should prioritize patching given the unauthenticated upload path, and review file upload logs and API access to the affected endpoint for signs of unauthorized .xsl/.zip uploads, and check for anomalous outbound requests or command execution originating from the GeoNetwork server process.
Mentioned in this report
Detection guidance
GeoNetwork XSLT Processor Command Execution via Uploaded XSL File
Detects suspicious child process execution (cmd.exe, bash, powershell) spawned by GeoNetwork Java process following .xsl file ingestion, indicative of XSLT code injection (CVE-2026-63219). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GeoNetwork XSLT Processor Command Execution via Uploaded XSL File
description: Detects GeoNetwork Java process spawning shell interpreters (cmd.exe,
bash, powershell.exe, sh) following .xsl file upload or processing, indicating unsafe
XSLT template evaluation. CVE-2026-63219 allows OS command execution via malicious
.xsl payloads processed by the XSLT engine.
tags:
- attack.t1059.001
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: java
ParentCommandLine|contains:
- geonetwork
- GeoNetwork
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \bash.exe
- \sh.exe
filter_legitimate:
CommandLine|contains:
- Microsoft Visual Studio
- Java build tool
condition: selection_parent and selection_child and not filter_legitimate
falsepositives:
- Legitimate GeoNetwork administrative tasks that invoke system commands for file
management
- GeoNetwork plugins or extensions that spawn subprocesses for authorized operations
level: high
id: 3e526a3b-c8c5-507a-aaf1-1c2dac96d24c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0343.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free