CVE-2026-39921
Description
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.
How to fix
- geosolutionsgroup geonode4.4.5, 5.0.2 or later
- geonode4.4.5, 5.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| geosolutionsgroup geonode | 4.0.0 ≤ v < 4.4.5, 5.0.0 ≤ v < 5.0.2 | 4.4.5, 5.0.2 |
| geonodePyPI | 4.0.0 ≤ v < 4.4.5, 5.0.0 ≤ v < 5.0.2 | 4.4.5, 5.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.