PT-2026-2375 · Geonetwork+2 · Geonetwork+1

Amel Bouziane-Leblond · Published 2026-01-13 · Updated 2026-02-27 · CVE-2022-50899

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Geonetwork versions 3.10 through 4.2.0

Description Geonetwork contains a flaw in its PDF rendering process related to XML external entities. This allows attackers to retrieve arbitrary files from the server. The issue stems from an insecure XML parser that can be exploited by crafting malicious XML documents with external entity references. Specifically, attackers can read system files through the baseURL parameter when making PDF creation requests.

Recommendations Versions prior to 4.2.1 should be updated.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-50899

Affected Products

Geonetwork

Core-Geonetwork

References · 6

• 🔥 https://exploit-db.com/exploits/50982 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50899 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50899 · Vendor Advisory
• https://vulncheck.com/advisories/geonetwork-xml-external-entity-xxe · Note
• https://t.me/cveNotify/153570 · Telegram Post
• https://geonetwork-opensource.org · Note