GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

OSGeo GeoServer ships the GeoTools library, which evaluates feature property names directly as XPath expressions without proper neutralization (CWE-95), so attacker-supplied input is executed as code rather than treated as data. A remote, unauthenticated attacker triggers the flaw by sending specially crafted requests to a GeoServer service, causing the injected expression to be evaluated in the server's context. Successful exploitation results in remote code execution on the host running GeoServer, giving the attacker control over the mapping server and any data or credentials it can reach. Any organization running GeoServer is affected, and the underlying GeoTools flaw also extends to dependent applications such as GeoNetwork, which shipped its own fix for an unauthenticated RCE chain affecting government geoportal backends. The flaw is being actively exploited: it was added to CISA KEV on 2024-07-15, and EPSS assigns a 99.8% probability of exploitation within 30 days.

Do: Upgrade GeoServer to the fixed releases identified in the OSGeo advisory (2.23.6, 2.24.4 or 2.25.2, or later); where upgrading is not immediately possible, restrict access to GeoServer's public endpoints per vendor mitigations or discontinue use of the product per the KEV required action. Organizations running GeoNetwork or other GeoTools-based applications should apply those vendors' fixes as well. Given active exploitation, hunt for signs of compromise such as unexpected child processes spawned by the GeoServer Java process, new files or services on the host, and unusual map/feature service request patterns.

GeoServer, an open source server for sharing and editing geospatial data, is vulnerable to an XML External Entity (XXE) injection flaw (CWE-611) tracked as CVE-2025-58360. The flaw is triggered when an unauthenticated XML request sent to the /geoserver/wms endpoint with operation GetMap is not sufficiently sanitized or restricted, allowing an attacker to define external entities in the request and have the server resolve them, which can lead to disclosure of local files, SSRF to internal services, and potentially further compromise. It carries a CVSS 3.1 score of 9.8 (critical) with high impact on confidentiality, integrity, and availability, and related reporting describes unauthenticated RCE chains affecting government geoportal backends in this software ecosystem. Any organization running GeoServer 2.26.0 up to but not including 2.26.2, or any version before 2.25.6, is affected. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-12-11, and EPSS assigns a 64.9% probability of exploitation within 30 days (99th percentile).

Do: Upgrade immediately to GeoServer 2.25.6, 2.26.3, or 2.27.0, which contain the fix. If patching is delayed, restrict or firewall access to the /geoserver/wms endpoint (particularly GetMap requests) and limit the server's ability to fetch external resources; federal agencies must follow BOD 22-01 guidance per the KEV listing. Review WMS access logs for suspicious XML entity usage and outbound connections or file-read activity from the GeoServer host as indicators of exploitation.

GeoNetwork versions before 4.4.12 and before 4.2.17 run the Saxon XSLT processor used to render formatters without secure processing (FEATURE_SECURE_PROCESSING) and without disabling Java extension functions (ALLOW_EXTERNAL_FUNCTIONS), so any stylesheet the application loads can invoke Java methods directly. A user with sufficient privileges to upload a formatter can deliver a malicious .xsl file that calls java.lang.Runtime.exec() or java.lang.ProcessBuilder, achieving arbitrary operating system command execution with the privileges of the GeoNetwork process. An attacker therefore gains code execution on the server (CVSS 9.1, scope-changing, critical), although network reachability requires an account that can upload formatters. All GeoNetwork deployments on the 4.4 branch prior to 4.4.12 and the 4.2 branch prior to 4.2.17 are affected, and related reporting highlights government geoportal backends as a key exposed population. No public proof-of-concept or confirmed in-the-wild exploitation is known (not in CISA KEV; EPSS ~1.2% over 30 days), though related headlines describe a fixed unauthenticated RCE chain affecting government geoportals, suggesting the flaw may be reachable through a longer attack chain.

Do: Upgrade GeoNetwork to 4.4.12 on the 4.4 branch or 4.2.17 on the 4.2 branch (or later). Until patched, restrict formatter upload privileges to trusted administrators only and audit existing uploaded .xsl formatter files for Java extension calls such as Runtime.exec or ProcessBuilder. Internet-exposed GeoNetwork instances, especially government geoportals, should be prioritized, and given the related unauthenticated RCE chain headline, review authentication and any chained entry points on affected servers.

GeoNetwork, the open-source catalog application for managing spatially referenced resources, is affected by a missing-authorization flaw (CWE-862) in the API endpoint used to create new formatters, which leaves its file upload unprotected in versions prior to 4.4.12 and 4.2.17. An unauthenticated attacker with network access to the API can upload arbitrary .xsl or .zip formatter files. This allows the attacker to write arbitrary files into the GeoNetwork formatter directory, an unauthorized write to server storage that the CVSS scores as a high-integrity, scope-changing impact, and related news coverage reports the issue being chained into unauthenticated remote code execution on government geoportal backends. Any deployment running GeoNetwork 4.4.x prior to 4.4.12 or 4.2.x prior to 4.2.17 where the formatter creation endpoint is reachable, particularly internet-exposed geoportals, is affected. No in-the-wild exploitation, public proof-of-concept, or KEV listing is currently known, and EPSS estimates roughly a 0.5% probability of exploitation within 30 days.

Do: Upgrade to GeoNetwork 4.4.12 or 4.2.17 as applicable. Until patched, restrict access to the formatter creation API (for example by requiring authentication or blocking the endpoint at a reverse proxy) and inspect the GeoNetwork formatter directory for unexpected .xsl or .zip files, since related coverage indicates the file write can be chained into remote code execution.