CVE-2026-63219

Name of the Vulnerable Software and Affected Versions GeoNetwork versions prior to 4.4.12 GeoNetwork versions prior to 4.2.17

Description An unprotected API endpoint used for creating new formatters via file upload allows unauthenticated attackers to upload arbitrary .xsl or .zip files. This enables unauthorized write access to the server storage by allowing files to be written directly into the GeoNetwork formatter directory.

Recommendations Update GeoNetwork to version 4.4.12 or later. Update GeoNetwork to version 4.2.17 or later.