CVE-2022-50899 Geonetwork 4.2.0 - XML External Entity (XXE)
Attackers can read arbitrary server files via XML external entity injection in PDF rendering requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-50899?
CVE-2022-50899 is a high-severity vulnerability in GeoNetwork, published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server. Attackers can exploit the insecure XML parser by crafting a malicious XML document with external entity references to read system files through the baseURL parameter in PDF creation requests.
Weakness: CWE-611
Which versions are affected by CVE-2022-50899?
It affects 1 product.
Products include Osgeo Geonetwork.
How do I fix CVE-2022-50899?
No fix has been published for CVE-2022-50899 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-50899 being exploited?
There is no known exploitation of CVE-2022-50899 in the wild and no public exploit code.
Other vulnerabilities in GeoNetwork
Sources
Also known as GHSA-q595-r7rh-mc9h.