Version 4.2.17

GeoNetwork 4.2.17 is a minor release.

Security Considerations

This release includes a security fix for a vulnerability affecting previous 4.2.x versions. All users are encouraged to update to 4.2.17 as soon as possible.

• CVE-2026-63219 Unauthenticated file upload via missing authorization on formatter upload endpoint
• CVE-2026-55864 Unauthenticated Server-Side Request Forgery in SLD Tool
• CVE-2026-58400 Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
• CVE-2026-69130 Map feature popup renders KML/vector description and attributes as raw HTML via innerHTML

Migration notes

Please note that GeoNetwork 4.2 is nearing end-of-life and you should plan your upgrade to GeoNetwork 4.4 at this time.

API changes

• Formatter limits
• Map viewer / WFS filter / remove unused SLD API endpoints

List of changes

• Fix delete users with metadata user feedback entries associated
• Formatter limits
• Formatter API consistent access control
• Map viewer / Sanitize layer attribution and popover
• Harvester / Fix when updating records
• Java and JS library updates

and more ... see 4.2.17-0 issues and pull requests for full details.