CVE Explorer

CVE-2026-39921

GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mit

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d54de03e3b04578b544548dd144b38451a197ca241a22bb0b47f5416ed6073a1

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","packageURL":"pkg:github/GeoNode/geonode","product":"GeoNode","repo":"https://github.com/GeoNode/geonode","vendor":"GeoNode","versions":[{"lessThan":"4.4.5","status":"affected","version":"4.0.0","versionType":"semver"},{"lessThan":"5.0.2","status":"affected","version":"5.0.0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:2dd0b960681641c0c6092aa0a598cc75c74d093f57780b77bf1440238a65b227 · sha256:7882b8dee64476cc… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LO…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:2dd0b960681641c0c6092aa0a598cc75c74d093f57780b77bf1440238a65b227 · sha256:7882b8dee64476cc… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-918","description":"Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:2dd0b960681641c0c6092aa0a598cc75c74d093f57780b77bf1440238a65b227 · sha256:7882b8dee64476cc… · /containers/cna/problemTypes/0/descriptions/0

Source references

6 source assertions

{"tags":["patch"],"url":"https://github.com/GeoNode/geonode/commit/4a852cfc1da732b10779b5bf5f087c8f02985571"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2dd0b960681641c0c6092aa0a598cc75c74d093f57780b77bf1440238a65b227 · sha256:7882b8dee64476cc… · /containers/cna/references/4

{"tags":["patch"],"url":"https://github.com/GeoNode/geonode/commit/9856cb5ab27e33c0adba9274f4cccf6d1f534bd1"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2dd0b960681641c0c6092aa0a598cc75c74d093f57780b77bf1440238a65b227 · sha256:7882b8dee64476cc… · /containers/cna/references/3

{"tags":["issue-tracking"],"url":"https://github.com/GeoNode/geonode/pull/14058"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2dd0b960681641c0c6092aa0a598cc75c74d093f57780b77bf1440238a65b227 · sha256:7882b8dee64476cc… · /containers/cna/references/2

{"tags":["release-notes","patch"],"url":"https://github.com/GeoNode/geonode/releases/tag/4.4.5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2dd0b960681641c0c6092aa0a598cc75c74d093f57780b77bf1440238a65b227 · sha256:7882b8dee64476cc… · /containers/cna/references/1

{"tags":["release-notes","patch"],"url":"https://github.com/GeoNode/geonode/releases/tag/5.0.2"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2dd0b960681641c0c6092aa0a598cc75c74d093f57780b77bf1440238a65b227 · sha256:7882b8dee64476cc… · /containers/cna/references/0

{"tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/geonode-ssrf-via-document-upload"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2dd0b960681641c0c6092aa0a598cc75c74d093f57780b77bf1440238a65b227 · sha256:7882b8dee64476cc… · /containers/cna/references/5

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer