Reflected XSS in GeoNetwork Catalog Application
CVE-2026-39379
7.1HIGH
What is CVE-2026-39379?
The GeoNetwork catalog application suffers from a reflected XSS vulnerability due to insufficient input validation when requesting nonexistent or unauthorized service URLs. This vulnerability allows remote attackers to craft malicious links that, when clicked by victims (including administrators), trigger the execution of attacker-controlled scripts in the context of the victim's browser. This results in potential unauthorized actions and information disclosure. It is crucial for administrators to upgrade to GeoNetwork versions 4.2.15 or 4.4.10 to mitigate this risk.
Affected Version(s)
core-geonetwork >= 3.0.0, <= 3.12.12 <= 3.0.0, 3.12.12
core-geonetwork >= 4.0.0-alpha.1, <= 4.0.6 <= 4.0.0-alpha.1, 4.0.6
core-geonetwork >= 4.2.0, < 4.2.15 < 4.2.0, 4.2.15