CVE-2026-58400
Received Received - Intake

Arbitrary Command Execution in GeoNetwork via XSLT

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-58400
EUVD
EUVD-2026-70645

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
geonetwork geonetwork to 4.2.17 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GeoNetwork allows authenticated users with sufficient privileges to upload a malicious XSLT file that can execute arbitrary OS commands on the server. The issue occurs because the Saxon XSLT processor is configured without secure processing and Java extension functions are enabled, allowing stylesheets to call Java methods like Runtime.exec() or ProcessBuilder.

Detection Guidance

Check GeoNetwork versions for 4.4.11 or earlier and 4.2.16 or earlier. Inspect uploaded .xsl files for Java extension calls like java.lang.Runtime.exec() or java.lang.ProcessBuilder. Monitor for unexpected command execution by the GeoNetwork process user.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain full control over the server running GeoNetwork, execute arbitrary commands, steal sensitive data, or disrupt services. The impact depends on the privileges of the GeoNetwork process user.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). Organizations using affected GeoNetwork versions may face legal and regulatory penalties.

Mitigation Strategies

Upgrade GeoNetwork to versions 4.4.12 or later, or 4.2.17 or later. Disable or restrict upload permissions for formatters. Review and remove any untrusted .xsl files. Implement network segmentation to limit exposure of the GeoNetwork service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58400. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart