PatchTheCVEgeonetwork vulnerabilities and fixes
Recent CVEs affecting geonetwork, with upgrade or downgrade steps. 3 tracked.
geonetwork has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-01-13. Highest priority: CVE-2025-30220 (score 69/100).
- CVE-2025-30220 CRITICAL 9.9 UPGRADE UPGRADE GeoServer is an open source server that allows users to share and edit geospatial data
- CVE-2024-32037 NONE 0.0 UPGRADE GeoNetwork is a catalog application to manage spatially referenced resources
- CVE-2022-50899 MEDIUM 6.5 UPGRADE Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attac
FAQ
How do I fix geonetwork vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is geonetwork being exploited right now?
None of the tracked geonetwork CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which geonetwork CVE should I patch first?
CVE-2025-30220 currently ranks highest (69/100): GeoServer is an open source server that allows users to share and edit geospatial data.