GeoNetwork vulnerabilities
We track 5 vulnerabilities in GeoNetwork products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest GeoNetwork vulnerabilities
- 7.5 High severity
core-geonetwork: Missing Authorization
GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query fie
- 7.1 High severity
core-geonetwork: Improper Neutralization of Input During Web Page Generation
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS ap
- 7.8 High severity
core-geonetwork: Server-Side Request Forgery
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attack
- 8.6 High severity
core-geonetwork: Missing Authorization
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthentic
- 9.1 Critical severity
core-geonetwork: Improper Control of Generation of Code
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Ja