CVE-2023-26043mediumCWE-611

CVE-2023-26043: medium-severity vulnerability in geonode

XML External Entity (XXE) injection in GeoServer style upload functionality

Published · Updated

Follow this CVE+ Monitor geonode+ Monitor geonode

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.8%
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
GeoNode · geonode
Related CVEs — geonode

In the same product, most dangerous first.

CVE-2023-42439HIGHGeoNode SSRF Bypass to return internal host dataEPSS 1.0%CVE-2023-40017HIGHGeonode Server Side Request Forgery vulnerabilityEPSS 0.8%CVE-2023-28442HIGHGeoserver for GeoNode sensitive information leakEPSS 0.6%CVE-2024-27091MEDIUMGeoNode stored XSS to full account takeoverEPSS 0.4%CVE-2026-55649MEDIUMGeoNode has Stored XSS in Documents metadata abstract fieldEPSS —CVE-2026-46429MEDIUMGeoNode: Unrestricted File UploadEPSS —