{"id":"CVE-2026-46429","aliases":["GHSA-fqpv-mq26-pr4j"],"url":"https://o3.security/vulnerability/CVE-2026-46429","summary":"GeoNode: Unrestricted File Upload","details":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.","published":"2026-11-06T19:40:54.131Z","modified":"2026-11-07T10:45:35.564517335Z","cvss":{"score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"geonode","fixedVersion":"5.0.3"}],"fix":{"url":"https://github.com/GeoNode/geonode/commit/16ec8b3914fe87d0a258c14cf73b0a4295bb072f","label":"GeoNode/geonode@16ec8b3"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46429.json"},{"type":"FIX","url":"https://github.com/GeoNode/geonode/commit/16ec8b3914fe87d0a258c14cf73b0a4295bb072f"},{"type":"FIX","url":"https://github.com/GeoNode/geonode/commit/239a6b49c925957197033831df5f20c4c13a14da"},{"type":"FIX","url":"https://github.com/GeoNode/geonode/pull/14223"},{"type":"FIX","url":"https://github.com/GeoNode/geonode/pull/14224"},{"type":"WEB","url":"https://github.com/GeoNode/geonode/releases/tag/5.0.3"},{"type":"ADVISORY","url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-fqpv-mq26-pr4j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46429"},{"type":"PACKAGE","url":"https://github.com/GeoNode/geonode"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-07T10:45:35.564517335Z"}}