GeoNode: OS command injection via file upload (CVE-2026-33050)
GeoNode versions prior to 5.1.0 are vulnerable to OS command injection via a malicious layer name in uploaded vector files, allowing authenticated attackers to achieve remote code execution.
CVE search metadata
CVE search record: CVE-2026-33050. Severity: high. CVSS: 8.8. KEV: no. Product: GeoNode (< 5.1.0). Brief: GeoNode: OS command injection via file upload (CVE-2026-33050). Brief link: https://feed.craftedsignal.io/briefs/2026-11-geonode-rce/
Triage facts
Revision 1- Applicability
- GeoNode (< 5.1.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 6, 21:14 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
GeoNode is vulnerable to OS command injection (CVE-2026-33050) when processing vector files. An attacker with low-level privileges can provide a crafted layer name within an uploaded vector file that is not properly neutralized, leading to the execution of arbitrary OS commands on the host server. The vulnerability is confirmed in versions prior to 5.1.0.
Impact
Successful exploitation allows an authenticated attacker with file upload capabilities to execute arbitrary commands on the underlying server, resulting in a full compromise of confidentiality, integrity, and availability.
Recommendation
- Upgrade GeoNode to version 5.1.0 or later immediately to apply the patch for CVE-2026-33050.
- Audit logs for unauthorized or unexpected file uploads and shell-execution patterns if GeoNode is exposed.
Immediate actions
Upgrade GeoNode to version 5.1.0 or later
Threat Hunt
Identify file upload requests to GeoNode containing shell metacharacters in parameters
Data: Web server access logs (HTTP POST requests to upload endpoints), Application logs showing file processing activities
Mitigations
Apply GeoNode 5.1.0
CVE-2026-33050