CVE-2026-63219 json
Unauthenticated file upload via missing authorization on formatter upload endpoint
published 2mo ago modified 2mo ago also EUVD-2026-70647 , GHSA-mh22-prqr-vf42
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository geonetwork/core-geonetwork. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
Patch / fix
Is CVE-2026-63219 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Affected products
- geonetwork core-geonetwork
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
- github.com /geonetwork/core-geonetwork/pull/9346
-
github.com
/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42
advisory
- docs.geonetwork-opensource.org /4.2/overview/change-log/version-4.2.17
- docs.geonetwork-opensource.org /4.4/overview/change-log/version-4.4.12
- thehackernews.com /2026/09/geonetwork-fixes-unauthenticated-rce.html
Sources
- CVE List CVE-2026-63219
- NVD CVE-2026-63219
- Maintainer advisory GHSA-mh22-prqr-vf42
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of geonetwork/core-geonetwork published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.