https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:14:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-221489 EUVD-2026-221489 https://cve.radiocsirt.org/vuln/euvd-2026-221489 https://cve.radiocsirt.org/vuln/fkie_cve-2023-26043 <p>GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.</p> <p>GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-26043 https://cve.radiocsirt.org/vuln/ghsa-mcmc-c59m-pqq8 <p><strong>Affected:</strong> PyPI: GeoNode</p> <p>### Summary GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read.</p> <p>### Details GeoNode&#39;s GeoServer has the ability to upload new styles for datasets through the [`dataset_style_upload` view](https://github.com/GeoNode/geonode/blob/99b0557da5c7db23c72ad39e466b88fe43edf82d/geonode/geoserver/urls.py#L70-L72).</p> <p>```py # https://github.dev/GeoNode/geonode/blob/99b0557da5c7db23c72ad39e466b88fe43edf82d/geonode/geoserver/views.py#L158-L159 @login_required def dataset_style_upload(request, layername): def respond(*args, **kw): kw[&#39;content_type&#39;] = &#39;text/html&#39; return json_response(*args, **kw) ... sld = request.FILES[&#39;sld&#39;].read() # 1 sld_name = None try: # Check SLD is valid ... sld_name = extract_name_from_sld(gs_catalog, sld, sld_file=request.FILES[&#39;sld&#39;]) # 2 except Exception as e: respond(errors=f&#34;The uploaded SLD file is not valid XML: {e}&#34;) name = data.get(&#39;name&#39;) or sld_name set_dataset_style(layer, data.get(&#39;title&#39;) or name, sld) return respond( body={ &#39;success&#39;: True, &#39;style&#39;: data.get(&#39;title&#39;) or name, # 3 &#39;updated&#39;: data[&#39;update&#39;]}) ```</p> <p>`dataset_style_upload` gets a user-provided file (`1`), pass it to `extract_name_from_sld` to extract an element from it (`2`) and return the former in the response (`3`).</p> <p>```py # https://github.dev/GeoNode/geonode/blob/99b055…</p> <p><strong>Affected:</strong> PyPI: GeoNode</p> <p>### Summary GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read.</p> <p>### Details GeoNode&#39;s GeoServer has the ability to upload new styles for datasets through the [`dataset_style_upload` view](https://github.com/GeoNode/geonode/blob/99b0557da5c7db23c72ad39e466b88fe43edf82d/geonode/geoserver/urls.py#L70-L72).</p> <p>```py # https://github.dev/GeoNode/geonode/blob/99b0557da5c7db23c72ad39e466b88fe43edf82d/geonode/geoserver/views.py#L158-L159 @login_required def dataset_style_upload(request, layername): def respond(*args, **kw): kw[&#39;content_type&#39;] = &#39;text/html&#39; return json_response(*args, **kw) ... sld = request.FILES[&#39;sld&#39;].read() # 1 sld_name = None try: # Check SLD is valid ... sld_name = extract_name_from_sld(gs_catalog, sld, sld_file=request.FILES[&#39;sld&#39;]) # 2 except Exception as e: respond(errors=f&#34;The uploaded SLD file is not valid XML: {e}&#34;) name = data.get(&#39;name&#39;) or sld_name set_dataset_style(layer, data.get(&#39;title&#39;) or name, sld) return respond( body={ &#39;success&#39;: True, &#39;style&#39;: data.get(&#39;title&#39;) or name, # 3 &#39;updated&#39;: data[&#39;update&#39;]}) ```</p> <p>`dataset_style_upload` gets a user-provided file (`1`), pass it to `extract_name_from_sld` to extract an element from it (`2`) and return the former in the response (`3`).</p> <p>```py # https://github.dev/GeoNode/geonode/blob/99b055…</p> https://cve.radiocsirt.org/vuln/ghsa-mcmc-c59m-pqq8 https://cve.radiocsirt.org/vuln/gsd-2023-26043 gsd-2023-26043 https://cve.radiocsirt.org/vuln/gsd-2023-26043 https://cve.radiocsirt.org/vuln/pysec-2023-15 <p><strong>Affected:</strong> PyPI: geonode</p> <p>GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.</p> <p><strong>Affected:</strong> PyPI: geonode</p> <p>GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3.</p> https://cve.radiocsirt.org/vuln/pysec-2023-15