PT-2026-84458

CVE-2026-58400

Published

2026-09-01

Updated

2026-10-01

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeoNetwork versions prior to 4.4.12 GeoNetwork versions prior to 4.2.17

Description The Saxon XSLT processor used to render formatters is configured without secure processing (FEATURE SECURE PROCESSING) and without disabling Java extension functions (ALLOW EXTERNAL FUNCTIONS). This allows a user with sufficient privileges to upload a .xsl file containing Java extension calls to the java.lang.Runtime.exec() or java.lang.ProcessBuilder functions, leading to arbitrary command execution with the privileges of the GeoNetwork process user.

Recommendations Update to version 4.4.12 or later. Update to version 4.2.17 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\'Unsafe Reflection\')

Related identifiers

CVE-2026-58400