{"id":"CVE-2026-46429","kind":"vulnerability","aliases":["CVE-2026-46429","GHSA-fqpv-mq26-pr4j"],"related":[],"title":"GeoNode has Unrestricted File Upload","description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.","summary":"GeoNode's upload validation can be bypassed with crafted requests, so the application accepts files it should reject. An attacker can store malicious files and have the server serve them to other users.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GeoNode","fixed":["5.0.3"],"affected":"<= 5.0.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-434","geonode","package","python","self-hosted"],"not_affected_if":["trusted-users-only","uploads-disabled"],"how_to_check":"- Check the installed GeoNode version with `pip show GeoNode` and compare it to the affected range (<= 5.0.2).\n- Confirm whether your GeoNode instance accepts uploads from users who are not trusted.","fix":"- Upgrade GeoNode to `5.0.3`.","status":"open","published_at":"2026-11-06T19:41:23+00:00","first_seen_at":"2026-11-06T19:43:22+00:00","triaged_at":"2026-11-06T19:43:40+00:00","updated_at":"2026-11-06T20:43:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T19:43:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GeoNode to `5.0.3`.","reach":"internet","title":"GeoNode: unrestricted file upload lets attackers store and serve malicious files","impact":"medium","summary":"GeoNode's upload validation can be bypassed with crafted requests, so the application accepts files it should reject. An attacker can store malicious files and have the server serve them to other users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["geonode","python","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"malicious files stored and served to other users","analyst_note":"","how_to_check":"- Check the installed GeoNode version with `pip show GeoNode` and compare it to the affected range (<= 5.0.2).\n- Confirm whether your GeoNode instance accepts uploads from users who are not trusted.","plain_action":"","needs_analyst":false,"not_affected_if":["uploads-disabled","trusted-users-only"],"who_is_affected":"GeoNode deployments at version 5.0.2 or earlier that accept file uploads through the upload service. Instances with uploads disabled or restricted to fully trusted users carry less exposure. unknown whether the sources name a specific default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000669,"input_tokens":4296,"output_tokens":479,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':7A,15A '-434':19B '-46429':8A,16A '5.0.3':78C,107C 'accept':39B 'allow':88C 'applic':38B 'attack':45B 'bypass':32B 'circumv':83C 'content':63C 'craft':34B,80C 'cve':6A,14A 'cwe':18B 'data':75C 'file':4A,40B,49B,100C 'fix':104C 'fqpv':11A 'geonod':1A,20B,26B,59C,84C 'geonode':17A 'geospati':62C,74C 'ghsa':10A 'ghsa-fqpv-mq26-pr4j':9A 'host':25B 'issu':102C 'low':91C 'low-privileg':90C 'malici':48B,99C 'manag':64C,70C 'mq26':12A 'packag':21B 'platform':67C 'pr4j':13A 'prior':76C 'privileg':92C 'public':72C 'python':22B 'reject':43B 'remot':93C 'request':35B,81C 'self':24B 'self-host':23B 'serv':54B,98C 'server':53B 'servic':86C 'special':79C 'store':47B,96C 'system':65C 'unrestrict':3A 'upload':5A,28B,85C 'user':58B,94C 'valid':29B,87C 'version':106C","nicknames":[],"mitigations":[],"who_affected":"GeoNode deployments at version 5.0.2 or earlier that accept file uploads through the upload service. Instances with uploads disabled or restricted to fully trusted users carry less exposure. unknown whether the sources name a specific default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["geonode"],"ptokens":["geonode"],"labels":["cwe434","geonode","medium","package","pypi","python","selfhosted"],"campaign_type":null,"search_a":"'-2026':7A,15A '-46429':8A,16A 'cve':6A,14A 'file':4A 'fqpv':11A 'geonod':1A 'geonode':17A 'ghsa':10A 'ghsa-fqpv-mq26-pr4j':9A 'mq26':12A 'pr4j':13A 'unrestrict':3A 'upload':5A","search_b":"'-434':19B 'accept':39B 'applic':38B 'attack':45B 'bypass':32B 'craft':34B 'cwe':18B 'file':40B,49B 'geonod':20B,26B 'host':25B 'malici':48B 'packag':21B 'python':22B 'reject':43B 'request':35B 'self':24B 'self-host':23B 'serv':54B 'server':53B 'store':47B 'upload':28B 'user':58B 'valid':29B","search_c":"'5.0.3':78C,107C 'allow':88C 'circumv':83C 'content':63C 'craft':80C 'data':75C 'file':100C 'fix':104C 'geonod':59C,84C 'geospati':62C,74C 'issu':102C 'low':91C 'low-privileg':90C 'malici':99C 'manag':64C,70C 'platform':67C 'prior':76C 'privileg':92C 'public':72C 'remot':93C 'request':81C 'serv':98C 'servic':86C 'special':79C 'store':96C 'system':65C 'upload':85C 'user':94C 'valid':87C 'version':106C","first_public_at":"2026-11-05T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-fqpv-mq26-pr4j","url":"https://github.com/advisories/GHSA-fqpv-mq26-pr4j","severity":"medium","published_at":"2026-11-06T19:41:23+00:00","modified_at":"2026-11-06T19:41:24+00:00","first_seen_at":"2026-11-06T19:43:22+00:00","fetched_at":"2026-11-06T19:53:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-46429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46429","severity":null,"published_at":"2026-11-06T20:17:22+00:00","modified_at":"2026-11-06T20:17:22+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:44:00+00:00","note":null}],"documents":[{"id":89214,"url":"https://api.github.com/repos/GeoNode/geonode/security-advisories/GHSA-fqpv-mq26-pr4j","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":89215,"url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-fqpv-mq26-pr4j","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-05T18:17:38+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":89216,"url":"https://github.com/GeoNode/geonode/pull/14223","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89217,"url":"https://github.com/GeoNode/geonode/pull/14224","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89218,"url":"https://github.com/GeoNode/geonode/commit/16ec8b3914fe87d0a258c14cf73b0a4295bb072f","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89219,"url":"https://github.com/GeoNode/geonode/commit/239a6b49c925957197033831df5f20c4c13a14da","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89220,"url":"https://github.com/GeoNode/geonode/releases/tag/5.0.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}