CVE-2026-63219: geonetwork core-geonetwork Missing Authorization

Vulnerability summary

CVE-2026-63219 is a high (CVSS 8.6) Missing Authorization vulnerability in geonetwork core-geonetwork. It is known to be exploited: ENISA lists it, first on 02-09-2026. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39% of scored vulnerabilities.

Timeline

1. 02-09-2026
   Added to ENISA KEVAdded to the ENISA known exploited vulnerabilities catalog.
2. 03-09-2026
   PublishedVulnerability first disclosed.
3. 03-09-2026
   Last modifiedVulnerability information updated.

Description

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.