Threats Tagged 'cve-2026-58400'

Multiple vulnerabilities have been fixed in GeoNetwork, an open-source catalog application maintained by OpenGeo. The affected versions include 4.4.5 through 4.4.11 and versions prior to 4.4.12 and 4.2.17. The vulnerabilities correspond to CWE-79 (Cross-site Scripting), CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), and CWE-862 (Missing Authorization). No CVSS score is provided, and no known exploits in the wild have been reported.

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.