CVE-2026-39921mediumCWE-918

CVE-2026-39921: medium-severity vulnerability in GeoNode

GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload

Published · Updated

Follow this CVE+ Monitor geonode+ Monitor geonode

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.2%
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L
Affected products
GeoNode · GeoNode
Related CVEs — GeoNode

In the same product, most dangerous first.

CVE-2026-39922MEDIUMGeoNode SSRF via Service RegistrationEPSS 0.2%