GHSA-2p76-gc46-5fvc

GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint

8.2 HighFix available

Impact

GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation.

This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files

Patches

GeoNetwork 4.4.8 / 4.2.13.

Workarounds

Remove the gn-wfsfeature-harvester and gn-camelPeriodicProducer jars, disabling the WFS Index functionality.

References

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: Low

What each source reports

GitHub Advisories Score used8.2

GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint

Impact

GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation.

This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files

Patches

GeoNetwork 4.4.8 / 4.2.13.

Workarounds

Remove the gn-wfsfeature-harvester and gn-camelPeriodicProducer jars, disabling the WFS Index functionality.

References

Record: GHSA-2p76-gc46-5fvc
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness: CWE-611, CWE-918
Updated: 2026-11-02

OSV8.2

GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint

Impact

GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation.

This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files

Patches

GeoNetwork 4.4.8 / 4.2.13.

Workarounds

Remove the gn-wfsfeature-harvester and gn-camelPeriodicProducer jars, disabling the WFS Index functionality.

References

Record: GHSA-2p76-gc46-5fvc
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness: CWE-611, CWE-918
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`org.geonetwork-opensource:gn-web-app` Maven	4.4.0 to 4.4.7	4.4.8
`org.geonetwork-opensource:gn-web-app` Maven	4.2.0 to 4.2.12	4.2.13
`org.geonetwork-opensource:gn-wfsfeature-harvester` Maven	4.4.0 to 4.4.7	4.4.8
`org.geonetwork-opensource:gn-wfsfeature-harvester` Maven	4.2.0 to 4.2.12	4.2.13
`org.geonetwork-opensource:gn-web-app` Maven	4.4.0 up to 4.4.8	4.4.8
`org.geonetwork-opensource:gn-web-app` Maven	4.2.0 up to 4.2.13	4.2.13
`org.geonetwork-opensource:gn-wfsfeature-harvester` Maven	4.4.0 up to 4.4.8	4.4.8
`org.geonetwork-opensource:gn-wfsfeature-harvester` Maven	4.2.0 up to 4.2.13	4.2.13

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-2p76-gc46-5fvc is a high vulnerability (CVSS 8.2) in org.geonetwork-opensource:gn-web-app, published June 10, 2025. No source lists public exploit code. Fixed in org.geonetwork-opensource:gn-web-app 4.4.8.