GeoNode OS command injection via uploaded file layer name
Servers running map data software can be taken over by uploaded files.
Summary
GeoNode is a geospatial content management system. Before 5.1.0, a low-privileged remote user can upload a crafted vector file whose layer name injects shell syntax, executing arbitrary operating-system commands on the server.
Affected when
- GeoNode before 5.1.0
- Ability to upload vector files
What to do
Update to version 5.1.0 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen