Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2022-50899Geonetwork 4.2.0 - XML External Entity (XXE)
Medium 6.5
In plain English
A medium-severity XML external entity in GeoNetwork from GeoNetwork. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 53.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server. Attackers can exploit the insecure XML parser by crafting a malicious XML document with external entity references to read system files through the baseURL parameter in PDF creation requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GeoNetwork | GeoNetwork | 3.10 – through 4.2.0 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-50982 exploit
- GeoNetwork Official Homepage product
- VulnCheck Advisory: Geonetwork 4.2.0 - XML External Entity (XXE) third-party-advisory