PT-2026-32033 · Geonode · Geonode

Elure · Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-39921

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GeoNode versions 4.0 through 4.4.5 and 5.0 through 5.0.2

Description GeoNode versions 4.0 through 4.4.5 and 5.0 through 5.0.2 contain a server-side request forgery issue. Authenticated users with document upload permissions can trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services, causing the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.

Recommendations Update to GeoNode version 4.4.5 or later. Update to GeoNode version 5.0.2 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-39921

Affected Products

Geonode

References · 9

• https://github.com/GeoNode/geonode/releases/tag/5.0.2 · Patch
• https://github.com/GeoNode/geonode/releases/tag/4.4.5 · Patch
• https://github.com/GeoNode/geonode/commit/4a852cfc1da732b10779b5bf5f087c8f02985571 · Patch
• https://github.com/GeoNode/geonode/commit/9856cb5ab27e33c0adba9274f4cccf6d1f534bd1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39921 · Security Note
• https://github.com/GeoNode/geonode/pull/14058 · Note
• https://twitter.com/VulmonFeeds/status/2042730768984600754 · Twitter Post
• https://twitter.com/CVEnew/status/2042710172947144853 · Twitter Post
• https://vulncheck.com/advisories/geonode-ssrf-via-document-upload · Note