{"id":"CVE-2026-33050","aliases":["EUVD-2026-118477","GHSA-9fpx-fr6j-2vh6"],"status":"published","title":"GeoNode: OS command injection via uploaded file layer name","description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00653,"percentile":0.51623,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2026-11-06T19:39:13Z","modified":"2026-11-09T13:17:08Z","exploits":[{"source":"pocgithub","id":"federiconbaez/cortex9-geonode-layer-name-command-injection-model","title":"federiconbaez/cortex9-geonode-layer-name-command-injection-model","date":"2026-11-09","url":"https://github.com/federiconbaez/cortex9-geonode-layer-name-command-injection-model"}],"fixes":[{"ecosystem":"PyPI","package":"geonode","fixed_in":["5.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"geonode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"geonode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0"}]}],"versions":["2.0","2.0.1","2.0.dev20130913181950","2.0.dev20140626191247","2.0b10","2.0b11","2.0b12","2.0b13","2.0b17","2.0b18","2.0b19","2.0b21","2.0b22","2.0b24","2.0b25","2.0b26","2.0b27","2.0b28","2.0b29","2.0b3","2.0b30","2.0b31","2.0b32","2.0b33","2.0b34","2.0b35","2.0b36","2.0b37","2.0b38","2.0b39","2.0b4","2.0b40","2.0b41","2.0b42","2.0b43","2.0b44","2.0b45","2.0b46","2.0b48","2.0b49","2.0b5","2.0b50","2.0b51","2.0b52","2.0b53","2.0b54","2.0b55","2.0b57","2.0b58","2.0b59","2.0b60","2.0b61","2.0b62","2.0b63","2.0b64","2.0b7","2.0c1","2.0c12","2.0c13","2.0c2","2.0c3","2.0c4","2.0c5","2.0c7","2.0c8","2.10","2.10.1","2.10.2","2.10.3","2.10.4","2.10rc0","2.10rc1","2.10rc2","2.10rc3","2.10rc4","2.10rc5","2.4","2.4.1","2.4a1","2.4a10","2.4a11","2.4a12","2.4a13","2.4a14","2.4a15","2.4a16","2.4a17","2.4a18","2.4a19","2.4a2","2.4a20","2.4a21","2.4a22","2.4a23","2.4a24","2.4a25","2.4a26","2.4a28","2.4a29","2.4a3","2.4a30","2.4a31","2.4a32","2.4a33","2.4a34","2.4a35","2.4a36","2.4a38","2.4a4","2.4a5","2.4a6","2.4a7","2.4a8","2.4a9","2.4b1","2.4b10","2.4b11","2.4b12","2.4b13","2.4b14","2.4b15","2.4b16","2.4b17","2.4b18","2.4b19","2.4b2","2.4b20","2.4b21","2.4b22","2.4b23","2.4b24","2.4b25","2.4b26","2.4b27","2.4b28","2.4b3","2.4b4","2.4b5","2.4b6","2.4b7","2.4b8","2.4c1","2.4c2","2.4c3","2.4c4","2.5.1","2.5.10","2.5.12","2.5.13","2.5.14","2.5.15","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.9","2.5.9.dev20170116091328","2.5.dev20160825082804","2.6","2.6.1","2.6.2","2.6.3","2.6a1","2.6c1","2.7","2.7.1.dev20171013151516","2.7.2.dev20171013181854","2.7.4.dev20171114161428","2.7.5.dev20180123130714","2.7.5.dev20180125135927","2.8","2.8.1","2.8.1rc0","2.8rc0","2.8rc1","2.8rc10","2.8rc11","2.8rc12","2.8rc13","2.8rc2","2.8rc3","2.8rc4","2.8rc5","2.8rc6","2.8rc7","2.8rc8","2.8rc9","3.0.0","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.3.post1","3.2.4","3.3.0","3.3.1","3.3.1.post1","3.3.2","3.3.2.post1","3.3.2.post2","3.3.3","4.0.0","4.0.0.post1","4.0.0rc0","4.0.0rc1","4.0.1","4.0.2","4.0.3","4.1.0","4.1.1","4.1.2","4.1.3","4.1.3.post1","4.1.4","4.1.5","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.3.0","4.3.0.post1","4.3.1","4.4.0","4.4.1","4.4.2","4.4.3","4.4.4","4.4.5","5.0.0","5.0.1","5.0.2","5.0.3","5.0.3.post1"]}],"products":[{"vendor":"geonode","product":"geonode"}],"references":[{"url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-9fpx-fr6j-2vh6","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/GeoNode/geonode/commit/1408290c0bb54872924a9b334a516db9758a2180","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/GeoNode/geonode/releases/tag/5.1.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-9fpx-fr6j-2vh6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33050.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33050","tags":["advisory"]},{"url":"https://github.com/GeoNode/geonode","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-33050","title":"GeoNode: OS command injection via uploaded file layer name","description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.","status":"published","published":"2026-11-06T19:39:13.68Z","modified":"2026-11-09T13:13:57.046Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-09T14:33:34.013968Z"}],"euvd":[{"id":"EUVD-2026-118477","description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.","status":"published","published":"2026-11-06T19:39:13Z","modified":"2026-11-09T13:13:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T22:07:16.414564Z"}],"ghsa":[{"id":"GHSA-9fpx-fr6j-2vh6","title":"GeoNode has OS command injection via uploaded file layer name","description":"Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name.","status":"published","published":"2026-11-06T19:39:38Z","modified":"2026-11-06T19:39:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-06T20:01:41.450648Z"}],"nvd":[{"id":"CVE-2026-33050","description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.","status":"published","published":"2026-11-06T20:17:22.57Z","modified":"2026-11-09T13:17:08.36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-06T22:02:17.053381Z"}],"osv":[{"id":"CVE-2026-33050","title":"GeoNode: OS command injection via uploaded file layer name","description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.","status":"published","published":"2026-11-06T19:39:13.68Z","modified":"2026-11-10T02:30:36.40306777Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-08T02:57:14.556074Z"},{"id":"GHSA-9fpx-fr6j-2vh6","title":"GeoNode has OS command injection via uploaded file layer name","description":"Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name.","status":"published","published":"2026-11-06T19:39:38Z","modified":"2026-11-06T19:45:05.134638894Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-06T20:08:20.701853Z"}]}}