{"action":"Upgrade geonode to 4.4.5 or later.","affected":[{"fixed":"4.4.5","introduced":"4.0.0"},{"fixed":"5.0.2","introduced":"5.0.0"}],"component":"geonode","cve_ids":["CVE-2026-39921"],"ecosystem":"PyPI","epss":0.00222,"exploited":false,"fixed_versions":["4.4.5","5.0.2"],"id":"tcs_01M5KGXSYVQF15E2W407PNBM7V","modified_at":"2026-07-13T07:15:30.200783468Z","published_at":"2026-04-10T20:16:22.083Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2159","https://github.com/GeoNode/geonode/releases/tag/4.4.5","https://github.com/GeoNode/geonode/releases/tag/5.0.2","https://www.vulncheck.com/advisories/geonode-ssrf-via-document-upload","https://github.com/GeoNode/geonode/commit/4a852cfc1da732b10779b5bf5f087c8f02985571","https://github.com/GeoNode/geonode/commit/9856cb5ab27e33c0adba9274f4cccf6d1f534bd1","https://github.com/GeoNode/geonode/pull/14058"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-2159","url":"https://osv.dev/vulnerability/PYSEC-2026-2159"}],"summary":"GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outboun"}