CVE-2026-63219
Summary
CVE-2026-63219 (CVSS 8.6) is a missing-authorisation check on GeoNetwork's formatter-upload endpoint that lets an anonymous user write arbitrary .xsl or .zip formatter files. When chained with an unsafe transformation engine, it enables unauthenticated remote code execution on GeoNetwork geoportal backends.
Details
GeoNetwork is the open-source geospatial metadata catalogue that sits behind many government and agency geoportals, including the European INSPIRE geoportal. The chain combines CVE-2026-63219's unauthorised formatter-write with an unsafe transformation engine to achieve unauthorised code execution. Fixes were shipped in versions 4.4.12 and 4.2.17 on 8 July 2026, with details published on 31 August 2026. GeoNetwork originated at the UN Food and Agriculture Organization and is maintained under the OSGeo umbrella.
Remediation
Government and agency geoportal operators running GeoNetwork should upgrade to versions 4.4.12 or 4.2.17 and review any externally exposed geoportal backends for existing compromise.