Answer in brief
CVE-2026-39921 records a Medium severity (CVSS 5.3) vulnerability in GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload. The current sources do not mark it as known exploited. The current feed maps GeoNode/GeoNode (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps GeoNode/GeoNode (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| GeoNode/GeoNodegeneric | >=4.0.0 <4.4.5 || >=5.0.0 <5.0.2 | 4.4.5, 5.0.2 |
Published upstream
Apr 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 8, 2026
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.
Quoted source text, attributed separately from HOL analysis.