Post

Rafael Castilho breaks down the discovery and exploitation of a Pre-Auth Remote Code Execution flaw in GeoNetwork. We recently disclosed 4 CVEs on it:

CVE-2026-63219 - Unauthenticated file upload via missing Authorization on formatter Upload Endpoint CVE-2026-55864 - Unauthenticated Server-Side Request Forgery in SLD Tool CVE-2026-57582 - Reflected XSS via unsanitized Javascript Sink CVE-2026-58400 - Remote Code Execution via unsafe Saxon XSLT