GHSA-5hx7-j24v-rffj

Source

https://github.com/advisories/GHSA-5hx7-j24v-rffj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5hx7-j24v-rffj/GHSA-5hx7-j24v-rffj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5hx7-j24v-rffj

Aliases

CVE-2026-55864

Published

2026-09-09T23:43:51Z

Modified

2026-09-10T00:10:57Z

Severity

7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool

Details

Summary

An unauthenticated server-side request forgery vulnerability lets any anonymous user make the GeoNetwork server issue arbitrary outbound HTTP requests. This gives an external attacker a position inside the server's network, making it possible to make internal requests no matter if the response is XML-type or not.

The SLD tooling endpoint POST /api/tools/ogc/sld takes a caller-supplied WMS server URL and performs a server-side HTTP GET to it, with no validation. The fetched body can also be stored and downloaded if the output of the outbound request is in XML format, making the SSRF non-blind.

Impact

Any unauthenticated user can make the server send arbitrary HTTP requests to internal hosts it would never expose publicly, and read the responses back if the request responses are XML. This enables internal data disclosure, for example, configuration files that return as XML, authorization bypass, and reconnaissance of the internal network all from an anonymous position.

Resolution

Patched releases:

4.4.12
4.2.17

Resources

https://github.com/geonetwork/core-geonetwork/pull/9343

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T23:43:51Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

Maven / org.geonetwork-opensource:gn-web-app

Package

Name: org.geonetwork-opensource:gn-web-app; View open source insights on deps.dev
Purl: pkg:maven/org.geonetwork-opensource/gn-web-app

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.4.0

Fixed

4.4.12

Database specific

last_known_affected_version_range

"<= 4.4.11"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5hx7-j24v-rffj/GHSA-5hx7-j24v-rffj.json"