# GeoNetwork patches XSS, code injection, upload flaws

Published: 2026-09-07 · Severity: elevated · Sectors: government-national, infrastructure, technology
Canonical: https://vorant.io/reports/6eb389c7-7da3-5a21-8e9e-ab30db977299/geonetwork-patches-xss-code-injection-upload-flaws

> OpenGeo fixed three vulnerabilities in GeoNetwork—reflected XSS, unauthenticated file upload, and unsafe XSLT processing—that can lead to server compromise; patch to 4.4.12 or 4.2.17.

NCSC-NL issued an advisory covering three vulnerabilities in GeoNetwork, an open-source metadata catalogue application, affecting versions 4.4.5 through 4.4.11 and all versions prior to 4.4.12 and 4.2.17. The most severe issue (CVE-2026-58400, CVSS 9.1) is an unprotected API endpoint that allows unauthenticated attackers to upload arbitrary .xsl or .zip files, granting unauthorized write access to the server and potentially leading to full server compromise. A second flaw (CVE-2026-63219, CVSS 8.6) stems from an insecure XSLT processor configuration that lets users with upload permissions execute arbitrary OS commands via uploaded .xsl files—an unsafe reflection/code injection issue. The third (CVE-2026-57582, CVSS 8.2) is a reflected XSS in the public, unauthenticated catalogue search function caused by insufficient sanitization of the uiconfig query parameter, allowing attackers to inject and execute JavaScript in victims' browser sessions.

No exploitation in the wild is reported; this is a coordinated disclosure with vendor patches already available. OpenGeo has released GeoNetwork 4.4.12 and 4.2.17 to remediate all three issues. Defenders running GeoNetwork should prioritize patching given the unauthenticated upload path, and review file upload logs and API access to the affected endpoint for signs of unauthorized .xsl/.zip uploads, and check for anomalous outbound requests or command execution originating from the GeoNetwork server process.

## Mentioned in this report

- Vulnerabilities: CVE-2026-57582 (templated), CVE-2026-58400, CVE-2026-63219

## Detection guidance (public sample)

### GeoNetwork XSLT Processor Command Execution via Uploaded XSL File

ATT&CK: T1059.001

Detects suspicious child process execution (cmd.exe, bash, powershell) spawned by GeoNetwork Java process following .xsl file ingestion, indicative of XSLT code injection (CVE-2026-63219). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GeoNetwork XSLT Processor Command Execution via Uploaded XSL File
description: Detects GeoNetwork Java process spawning shell interpreters (cmd.exe,
  bash, powershell.exe, sh) following .xsl file upload or processing, indicating unsafe
  XSLT template evaluation. CVE-2026-63219 allows OS command execution via malicious
  .xsl payloads processed by the XSLT engine.
tags:
- attack.t1059.001
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: java
    ParentCommandLine|contains:
    - geonetwork
    - GeoNetwork
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \bash.exe
    - \sh.exe
  filter_legitimate:
    CommandLine|contains:
    - Microsoft Visual Studio
    - Java build tool
  condition: selection_parent and selection_child and not filter_legitimate
falsepositives:
- Legitimate GeoNetwork administrative tasks that invoke system commands for file
  management
- GeoNetwork plugins or extensions that spawn subprocesses for authorized operations
level: high
id: 3e526a3b-c8c5-507a-aaf1-1c2dac96d24c
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0343.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6eb389c7-7da3-5a21-8e9e-ab30db977299/geonetwork-patches-xss-code-injection-upload-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup