---
id: "CVE-2026-46429"
page: "https://infrastack.ai/live/CVE-2026-46429"
kind: "vulnerability"
aliases: ["CVE-2026-46429", "GHSA-fqpv-mq26-pr4j"]
title: "GeoNode has Unrestricted File Upload"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "GeoNode", "fixed": ["5.0.3"], "affected": "<= 5.0.2", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-434", "geonode", "package", "python", "self-hosted"]
not_affected_if: ["trusted-users-only", "uploads-disabled"]
published_at: "2026-11-06T19:41:23+00:00"
first_seen_at: "2026-11-06T19:43:22+00:00"
updated_at: "2026-11-06T20:43:59+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-fqpv-mq26-pr4j", "first_seen_at": "2026-11-06T19:43:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46429", "first_seen_at": "2026-11-06T20:43:59+00:00"}]
exploit_sources: []
---

# GeoNode has Unrestricted File Upload

Link for people: https://infrastack.ai/live/CVE-2026-46429 (this .md is for agents)

GeoNode's upload validation can be bypassed with crafted requests, so the application accepts files it should reject. An attacker can store malicious files and have the server serve them to other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:GeoNode affected <= 5.0.2 fixed 5.0.3

## How to check

- Check the installed GeoNode version with `pip show GeoNode` and compare it to the affected range (<= 5.0.2).
- Confirm whether your GeoNode instance accepts uploads from users who are not trusted.

## Fix

- Upgrade GeoNode to `5.0.3`.

## Timeline

- 2026-11-06T19:43:22+00:00 ghsa https://github.com/advisories/GHSA-fqpv-mq26-pr4j
- 2026-11-06T20:43:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-46429

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/GeoNode/geonode/security-advisories/GHSA-fqpv-mq26-pr4j
- [advisory] Maintainer's advisory: github.com https://github.com/GeoNode/geonode/security/advisories/GHSA-fqpv-mq26-pr4j
- [fix] Patch: github.com https://github.com/GeoNode/geonode/pull/14223
- [fix] Patch: github.com https://github.com/GeoNode/geonode/pull/14224
- [fix] Patch: github.com https://github.com/GeoNode/geonode/commit/16ec8b3914fe87d0a258c14cf73b0a4295bb072f
- [fix] Patch: github.com https://github.com/GeoNode/geonode/commit/239a6b49c925957197033831df5f20c4c13a14da
- [fix] Release: github.com https://github.com/GeoNode/geonode/releases/tag/5.0.3

## From the sources

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_