GHSA-2p76-gc46-5fvc GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
Unauthenticated attackers can exploit an XXE vulnerability in the WFS indexing API to read sensitive files from the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2p76-gc46-5fvc?
GHSA-2p76-gc46-5fvc is a vulnerability in org.geonetwork-opensource:gn-web-app, published on 10 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity (XXE) vulnerability during schema validation.
This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files
Patches
GeoNetwork 4.4.8 / 4.2.13.
Workarounds
Remove the gn-wfsfeature-harvester and gn-camelPeriodicProducer jars, disabling the WFS Index functionality.
References
Which versions are affected by GHSA-2p76-gc46-5fvc?
8 open source packages ship an affected version, including org.geonetwork-opensource:gn-web-app and org.geonetwork-opensource:gn-wfsfeature-harvester.
| Package | Affected | Fixed in |
|---|---|---|
org.geonetwork-opensource:gn-web-app Maven | From 4.2.0 | 4.2.13 |
org.geonetwork-opensource:gn-web-app Maven | From 4.2.0 | 4.2.13 |
org.geonetwork-opensource:gn-web-app Maven | From 4.4.0 | 4.4.8 |
org.geonetwork-opensource:gn-web-app Maven | From 4.4.0 | 4.4.8 |
org.geonetwork-opensource:gn-wfsfeature-harvester Maven | From 4.2.0 | 4.2.13 |
org.geonetwork-opensource:gn-wfsfeature-harvester Maven | From 4.2.0 | 4.2.13 |
2 more packages
org.geonetwork-opensource:gn-wfsfeature-harvester Maven | From 4.4.0 | 4.4.8 |
org.geonetwork-opensource:gn-wfsfeature-harvester Maven | From 4.4.0 | 4.4.8 |
How do I fix GHSA-2p76-gc46-5fvc?
Upgrade org.geonetwork-opensource:gn-web-app to a fixed version for your release line: 4.2.13 or 4.4.8.
Is GHSA-2p76-gc46-5fvc being exploited?
There is no known exploitation of GHSA-2p76-gc46-5fvc in the wild and no public exploit code.