CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Called exploited 1 days before disclosure.
Measured from the CVE publication date to the earliest of 2 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing1d
- Last KEV listing1d
- Last sightingsame day
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federaldoes not list it
- EUVDENISA, European Unionlisted Sep 2, 2026
- VulnCheck KEVcommercial researchlisted Sep 3, 2026
- CIRCLaggregator, mirrors the abovelisted Sep 2, 2026, not counted
2 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationeuvd.enisa.europa.eu/vulnerability/EUVD-2026-70647
1 public report collected from VulnCheck and CIRCL, first on Sep 3, 2026. Each links to its original source. We have not verified them.
Description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.