Version 4.4.12

GeoNetwork 4.4.12 is a minor release.

Security Considerations

This release includes a security fix for a vulnerability affecting previous 4.4.x versions. All users are strongly encouraged to update to 4.4.12 as soon as possible.

• CVE-2026-63219 Unauthenticated file upload via missing authorization on formatter upload endpoint
• CVE-2026-55864 Unauthenticated Server-Side Request Forgery in SLD Tool
• CVE-2026-57582 Reflected XSS via unsanitized Javascript Sink
• CVE-2026-58400 Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
• CVE-2026-69130 Map feature popup renders KML/vector description and attributes as raw HTML via innerHTML

Migration notes

API changes

• Map viewer / WFS filter / remove unused SLD API endpoints

List of changes

• Index / Add Swedish language
• Formatter limits
• Formatter API consistent access control
• Harvester / Fix when updating records
• Harvester / CSW / GetRecords fails when requesting an outputSchema not supported by a metadata schema
• Map viewer / Sanitize layer attribution and popover
• OAI-PMH / Apply privileges filter
• Admin user can't publish/unpublish metadata
• Java and JS library updates

and more ... see 4.4.12-0 issues and pull requests for full details.