CVE-2022-50899CWE-611

Geonetwork 4.2.0 - XML External Entity (XXE)

High · published January 13, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server. Attackers can exploit the insecure XML parser by crafting a malicious XML document with external entity references to read system files through the baseURL parameter in PDF creation requests.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00551 · 45.3th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-01-13T22:51Z
EPSS history
Timeline
  • 13 JAN 22:51Z
    Geonetwork 4.2.0 - XML External Entity (XXE)
    cvelistv5