CVE-2026-39921

GeoNode versions 4.0 through 4.4.4 and 5.0 through 5.0.1 contain a server-side request forgery vulnerability in the document upload functionality. The flaw allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by injecting malicious URLs through the doc_url parameter, enabling potential access to internal network resources, loopback addresses, and cloud metadata services. The vulnerability presents a MEDIUM severity risk with a CVSS v3.1 score of 6.3. It requires network access and low-level privileges (authenticated user status) but no user interaction. The attack vector could lead to confidentiality, integrity, and availability impacts through unauthorized access to internal systems and services that the compromised GeoNode server can reach. There is currently no indication of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog, and community engagement remains limited based on available metrics. Organizations running affected versions should prioritize patching to versions 4.4.5 or 5.0.2 or later as part of routine vulnerability management, particularly if their GeoNode instances operate in environments with sensitive internal services.