GHSA-2P76-GC46-5FVC: gn-web-app Maven
Vulnerability summary
GHSA-2P76-GC46-5FVC is a high (CVSS 8.2) vulnerability in gn-web-app Maven.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 10-06-2025PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint ### Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files ### Patches GeoNetwork 4.4.8 / 4.2.13. ### Workarounds Remove the ``gn-wfsfeature-harvester`` and ``gn-camelPeriodicProducer`` jars, disabling the WFS Index functionality. ### References - [GHSA-826p-4gcg-35vw](https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw) - https://github.com/geonetwork/core-geonetwork/pull/8757 - https://github.com/geonetwork/core-geonetwork/pull/8803 - https://github.com/geonetwork/core-geonetwork/pull/8812
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Org.geonetwork-opensource2 products
- gn-web-app≥ 4.4.0, < 4.4.8 | ≥ 4.2.0, < 4.2.13
- gn-wfsfeature-harvester≥ 4.4.0, < 4.4.8 | ≥ 4.2.0, < 4.2.13
1 vendor · 2 products