GeoNetwork Formatter Flaws Open Government Backends
Ethiack said GeoNetwork fixed two formatter flaws on July 8, with details published August 31, that can be chained into unauthenticated remote code execution in GeoNetwork 4.4.11 and earlier 4.2.16 and earlier. The bugs are CVE-2026-63219 and CVE-2026-58400, and the project shipped fixes in 4.4.12 and 4.2.17.
The chain starts with an upload endpoint that should have required authorization but did not, letting an anonymous user place a malicious .xsl or .zip formatter on the server. GeoNetwork then feeds that formatter into its Saxon transformation engine, which can execute operating-system commands as the GeoNetwork process user, so the render step becomes code execution.
That matters most where GeoNetwork sits behind geoportals and shared Spatial Data Infrastructure services: the exposed formatter path is the trust break, and a compromise can reach the backend catalog many portals inherit. Ethiack said it found 121 internet-exposed affected deployments across 39 countries, mostly government, military, or national-agency systems.