PT-2026-2375 · Geonetwork+2 · Geonetwork+1

Amel Bouziane-Leblond · CVE-2022-50899 · Published 2026-01-13 · Updated 2026-02-27

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Geonetwork versions 3.10 through 4.2.0

Description Geonetwork contains a flaw in its PDF rendering process related to XML external entities. This allows attackers to retrieve arbitrary files from the server. The issue stems from an insecure XML parser that can be exploited by crafting malicious XML documents with external entity references. Specifically, attackers can read system files through the baseURL parameter when making PDF creation requests.

Recommendations Versions prior to 4.2.1 should be updated.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-50899

Affected Products

Geonetwork

Core-Geonetwork

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50899.json · Exploit
• 🔥 https://exploit-db.com/exploits/50982 · Exploit
• https://osv.dev/vulnerability/CVE-2022-50899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50899 · Security Note
• https://geonetwork-opensource.org · Note
• https://t.me/cveNotify/153570 · Telegram Post
• https://vulncheck.com/advisories/geonetwork-xml-external-entity-xxe · Note