Unauthenticated attackers can chain two GeoNetwork flaws into remote code execution on government geoportal servers.