CVE-2026-46429

CVSS 5.5 (medium) · published 2026-11-06

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.

Weakness: CWE-434

Source: NVD CVE-2026-46429

References

• https://github.com/GeoNode/geonode/commit/16ec8b3914fe87d0a258c14cf73b0a4295bb072f
• https://github.com/GeoNode/geonode/commit/239a6b49c925957197033831df5f20c4c13a14da
• https://github.com/GeoNode/geonode/pull/14223
• https://github.com/GeoNode/geonode/pull/14224
• https://github.com/GeoNode/geonode/releases/tag/5.0.3
• https://github.com/GeoNode/geonode/security/advisories/GHSA-fqpv-mq26-pr4j

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.