CVE-2026-63219

GeoNetwork (open-source geospatial metadata catalog) has a missing authorization flaw on its formatter upload endpoint, introduced when a Spring @PreAuthorize annotation was dropped during the 4.0.6 refactor. An unauthenticated attacker can upload arbitrary .xsl or .zip formatter files to the ser...

CVE-2026-63219 Unauthenticated file upload via missing authorization on formatter upload endpoint

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary .x...