External risk intelligence

GeoNetwork Command Execution via XSLT Processing

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-58400

GeoNetwork is a web-based catalog application typically deployed as a public-facing portal to manage and share spatially referenced resources. While the vulnerability requires authenticated access to upload a formatter, the application itself is designed to be an internet-accessible service, making the management interface and its functions commonly reachable in standard deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in GeoNetwork, a catalog application for managing spatial data. The flaw allows a user with upload privileges to execute arbitrary commands on the server, potentially impacting system integrity. The main concern is confirming relevance and exposure.

Malicious files can run commands on the server.
Affects systems managing spatial data online.
Confirm if GeoNetwork is in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by uploading a specially crafted stylesheet file to the GeoNetwork catalog. This file, when processed by the application, allows the attacker to execute arbitrary operating system commands with the same permissions as the GeoNetwork process.

Requires authenticated access to upload files.
Triggered by loading a malicious stylesheet.
Enables arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a user with privileges to upload formatters could deliver a malicious XSL file. This file could exploit a misconfiguration in the Saxon XSLT processor to execute arbitrary operating system commands as the GeoNetwork process user.

System commands.
Malicious stylesheet upload.
Arbitrary command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability, the GeoNetwork application owners and the platform or infrastructure teams responsible for its deployment must collaborate. The immediate practical step is to identify all GeoNetwork instances, determine their reachability and business criticality, and confirm the accountable owner for each. This information will inform a prioritized remediation plan, coordinating with the vendor for updates and planning necessary maintenance windows.

Application owners and infrastructure teams.
Confirm GeoNetwork instance reachability and criticality.
Plan for updates or vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GeoNetwork?

GeoNetwork is an open-source software platform used to organize, manage, and share spatially referenced resources, such as maps and geographic datasets. It functions as a web-based catalog, allowing organizations to maintain metadata and provide access to spatial information. Because it is often used as a public-facing portal for data sharing, it frequently sits in network environments where users and researchers can easily access it.

What does CVE-2026-58400 mean for GeoNetwork security?

This vulnerability falls under the class of Improper Control of Generation of Code (CWE-94) and Use of Externally-Controlled Input to Select Classes or Code (CWE-470). Essentially, the application uses an XSLT processor that is not properly locked down. Because it allows external Java functions to run during file processing, a specially crafted stylesheet can trick the system into executing unauthorized commands on the underlying server.

How is this vulnerability triggered?

The flaw is triggered when the application processes a malicious XSL stylesheet uploaded by a user. An attacker must have specific privileges to upload these formatters to the system for the exploit to occur. Simply visiting the site or viewing existing, legitimate spatial resources does not trigger the vulnerability, as it requires the deliberate introduction of a harmful file into the formatter upload process.

Do I need to worry about this if my GeoNetwork instance is internal?

Yes, it is relevant regardless of network placement. While Halo Surface Signal notes that GeoNetwork is frequently deployed as an internet-facing portal, the risk remains for internal instances as well. The vulnerability relies on having upload privileges; if an unauthorized person or a compromised account gains that access, they could execute commands on the server regardless of whether the system is exposed to the broader internet.

When should I update my GeoNetwork software?

You should prioritize updating as soon as possible. Since this vulnerability allows arbitrary command execution, the immediate first step is to inventory your environment to locate all running instances of GeoNetwork. Once you have identified them, coordinate with your infrastructure team to apply the vendor-provided patches—versions 4.4.12 or 4.2.17—to ensure the XSLT processor is correctly configured with secure processing features enabled.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.