CVE-2026-63219
Received Received - Intake

Unauthenticated File Upload in GeoNetwork

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-63219
EUVD
EUVD-2026-70647

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
geonetwork geonetwork to 4.2.17 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GeoNetwork is a catalog application for managing spatially referenced resources. This vulnerability affects versions before 4.4.12 and 4.2.17. The API endpoint for creating new formatters via file upload is unprotected, allowing unauthenticated attackers to upload arbitrary .xsl or .zip files. These files can be written to the formatter directory on the server, enabling unauthorized write access to server storage.

Detection Guidance

Check for unauthorized .xsl or .zip files in the GeoNetwork formatter directory. Review server logs for unexpected file uploads or POST requests to the formatter API endpoint. Ensure no unprotected endpoints are exposed to unauthenticated users.

Impact Analysis

An unauthenticated attacker could exploit this to upload malicious files to your server, potentially leading to unauthorized file writes, data corruption, or further attacks. This could compromise system integrity, expose sensitive data, or allow attackers to gain control over the server.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data integrity and confidentiality requirements or HIPAA's security rules for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade GeoNetwork to version 4.4.12 or 4.2.17 or later. If immediate upgrade is not possible, restrict access to the formatter API endpoint and disable unauthenticated file uploads. Monitor for suspicious file uploads and remove any unauthorized files found.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63219. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart