{"cve":"CVE-2026-39921","nvd":{"published":"2026-04-10T20:16:22.083","modified":"2026-07-14T21:16:47.213","status":"Modified","description":"GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L","score":5.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},"cwes":["CWE-918"],"references":["https://github.com/GeoNode/geonode/commit/4a852cfc1da732b10779b5bf5f087c8f02985571","https://github.com/GeoNode/geonode/commit/9856cb5ab27e33c0adba9274f4cccf6d1f534bd1","https://github.com/GeoNode/geonode/pull/14058","https://github.com/GeoNode/geonode/releases/tag/4.4.5","https://github.com/GeoNode/geonode/releases/tag/5.0.2"],"products":["geosolutionsgroup:geonode"],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2026-39921","score":0.00222,"percentile":0.12814,"date":"2026-10-31"},"kev":null,"osv":[{"id":"PYSEC-2026-2159","url":"https://osv.dev/vulnerability/PYSEC-2026-2159","summary":"","modified":"2026-07-13T07:15:30.200783468Z","packages":[{"ecosystem":"PyPI","name":"geonode","purl":"pkg:pypi/geonode","ranges":[">=4.0.0 <4.4.5",">=5.0.0 <5.0.2"],"fixed":["4.4.5","5.0.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}