CVE-2026-58400

Name of the Vulnerable Software and Affected Versions GeoNetwork versions prior to 4.4.12 GeoNetwork versions prior to 4.2.17

Description The Saxon XSLT processor used to render formatters is configured without secure processing (FEATURE SECURE PROCESSING) and without disabling Java extension functions (ALLOW EXTERNAL FUNCTIONS). This allows a user with sufficient privileges to upload a .xsl file containing Java extension calls to the java.lang.Runtime.exec() or java.lang.ProcessBuilder functions, leading to arbitrary command execution with the privileges of the GeoNetwork process user.

Recommendations Update to version 4.4.12 or later. Update to version 4.2.17 or later.