A crucial open-source component underpinning many governmental and agency geoportals, **GeoNetwork**, has been found vulnerable to a critical RCE chain. The project, maintained under the **Open Source Geospatial Foundation (OSGeo)**, patched these issues in versions 4.4.12 and 4.2.17 on July 8, 2026, with vulnerability details published on August 31. **GeoNetwork** originated at the **United Nations Food and Agriculture Organization** and is a core element of various Spatial Data Infrastructure deployments, including the backend of the European **INSPIRE geoportal**.  ### The Vulnerability Chain Explained The exploit chain leverages two distinct flaws: a missing authorization check and an insecure transformation engine. 1. **CVE-2026-63219 (CVSS: 8.6)**: This is a missing authorization check on the formatter upload endpoint. It allows an anonymous user to upload arbitrary `.xsl` or `.zip` formatter files to the **GeoNetwork** formatter directory, granting unauthorized write access to server storage. 2. **CVE-2026-58400 (CVSS: 9.1)**: This flaw concerns an unsafe configuration of the **Saxon** Extensible Stylesheet Language Transformations (**XSLT**) processor used for rendering formatters. Although **Saxon** runs with secure processing enabled and Java extension functions disabled, a loaded stylesheet can still invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` to execute operating-system commands as the **GeoNetwork** process user. On its own, this vulnerability requires elevated privileges to upload a formatter, hence its high-privilege CVSS score. Chaining these two vulnerabilities removes the privilege precondition. An attacker can first upload a malicious formatter via the unprotected endpoint. Subsequently, a GET request to a public record triggers the **Saxon** engine, executing the malicious stylesheet and leading to remote code execution. Security vendor **Ethiack**, whose researcher **Rafael Castilho** reported the flaws, identified that the chain is exploitable in **GeoNetwork** versions starting from 4.0.6, where a refactoring of the formatter endpoint inadvertently removed the authorization line.  ### Widespread Impact and Mitigation **Ethiack**'s research indicated 121 internet-exposed **GeoNetwork** deployments running vulnerable versions across 39 countries, with 89% linked to government, military, or national agencies. It's important to note these figures represent exposed instances, not confirmed compromises. All 4.4.x releases up to and including 4.4.11, and all 4.2.x releases up to and including 4.2.16, are affected. The project strongly advises all users to upgrade to versions 4.4.12 or 4.2.17 immediately. For administrators unable to apply the update immediately, interim mitigation involves blocking write methods to the formatter endpoint at the reverse proxy. This prevents legitimate formatter uploads via the admin console but also blocks the attack vector. Recommended interim rules: * **Apache httpd**: Deny `POST`, `PUT`, and `PATCH` requests to the `/geonetwork/srv/api/formatters` location. * **Nginx**: Restrict the same location to `GET`, `HEAD`, and `OPTIONS` methods. While the flaws were fixed approximately eight weeks before public disclosure, there's no current indication of their presence in **CISA**'s Known Exploited Vulnerabilities catalog or public reports of active exploitation. ### A Troubling Trend in Geospatial Security This disclosure follows a series of security incidents within the broader geospatial technology stack. Last year, a critical **GeoServer** flaw (**CVE-2024-36401**, CVSS: 9.8) was exploited to deploy botnets, cryptocurrency miners, and the **SideWalk** backdoor. Another **GeoServer** XML External Entity (**XXE**) flaw (**CVE-2025-58360**) was added to **CISA**'s KEV catalog in December 2025 due to active exploitation. Just last month, an unpatched **GeoServer** zero-day, an unauthenticated SQL injection leading to RCE, saw active probing shortly after public disclosure. These recurring issues highlight the critical need for enhanced security practices within geospatial platforms.