CVE-2026-46429 PUBLISHED

GeoNode: Unrestricted File Upload

Assigner: GitHub_M
Reserved: 13.05.2026 Published: 06.11.2026 Updated: 06.11.2026

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS Score: 5.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	Low
User Interaction	Required	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	GeoNode
Product	geonode
Versions	Version < 5.0.3 is affected

References

https://github.com/GeoNode/geonode/security/advisories/GHSA-fqpv-mq26-pr4j
https://github.com/GeoNode/geonode/pull/14223
https://github.com/GeoNode/geonode/pull/14224
https://github.com/GeoNode/geonode/commit/16ec8b3914fe87d0a258c14cf73b0a4295bb072f
https://github.com/GeoNode/geonode/commit/239a6b49c925957197033831df5f20c4c13a14da
https://github.com/GeoNode/geonode/releases/tag/5.0.3

Problem Types

CWE-434: Unrestricted Upload of File with Dangerous Type CWE