CVE-2026-58400: core-geonetwork, actief misbruikt
- Actief misbruik
- Ja, bevestigd
- Hoogste CVSS
- 9,1 kritiek
- Kans op misbruik (EPSS)
- 1,2%
- Prioriteit
- 55 van 100
Uit de melding
GeoNetwork is a catalog application to manage spatially referenced resources.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`).ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user.
xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process.17.
Lees de volledige melding bij ENISA EU Vulnerability DatabaseBron: ENISA EU Vulnerability Database, ENISA, hergebruik met bronvermelding.