Executive brief
GeoNetwork is a web-based catalog application that manages geographic and spatial data resources. The Saxon XSLT processor, which GeoNetwork uses to render formatters for display purposes, is misconfigured and allows users with formatter-upload privileges to execute arbitrary system commands with the full privileges of the GeoNetwork application. This could allow an attacker to compromise the server, steal data, or disrupt operations.
Technical details
The vulnerability stems from unsafe configuration of the Saxon XSLT processor: secure processing (FEATURE_SECURE_PROCESSING) is disabled and Java extension functions (ALLOW_EXTERNAL_FUNCTIONS) are not restricted. This allows any XSLT stylesheet loaded by GeoNetwork to invoke java.lang.Runtime.exec() or java.lang.ProcessBuilder directly. An attacker with sufficient privileges to upload a formatter can craft a malicious .xsl file containing Java extension calls that execute arbitrary OS commands. The attack requires formatter-upload privileges but has no network restriction—the payload is processed server-side during stylesheet rendering. Patches are available in GeoNetwork 4.4.12 and 4.2.17.
Affected products
- GeoNetwork GeoNetwork 4.4.0–4.4.11, 4.2.0–4.2.16
Timeline
- 2026-09-03: disclosed