CVE-2023-26043

MEDIUM

GeoNode < 4.0.3 - XML External Entity Injection via Style Upload

Title source: llm
STIX 2.1

Description

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0084
EPSS Percentile 53.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-611
Status published
Products (2)
geosolutionsgroup/geonode < 4.0.3
pypi/GeoNode 0 - 4.0.3PyPI
Published Feb 27, 2023
Tracked Since Feb 18, 2026