---
id: 7278
title: "GeoNetwork - PreAuth Remote Code Execution"
source_domain: ethiack.com
source_url: "https://ethiack.com/info-hub/research/geonetwork-preauth-RCE"
published_at: "2026-08-31T00:00:00Z"
tags: ["rce", "open-source", "pre-auth", "xslt", "geospatial", "geonetwork"]
phying_url: "https://phying.com/item/7278"
lang: en
---

# GeoNetwork - PreAuth Remote Code Execution

## Summary

Four bugs in the GeoNetwork geospatial catalog include a missing @PreAuthorize check enabling unauthenticated file upload and remote code execution via an unsafe Saxon XSLT configuration.

## Intelligence Metadata

- **Sources:** ethiack.com
- **Published:** 2026-08-31T00:00:00Z
- **Original:** https://ethiack.com/info-hub/research/geonetwork-preauth-RCE
- **Phying News:** https://phying.com/item/7278