CVE-2026-42351 json
pygeoapi: Path Traversal in STAC FileSystemProvider
published 2026-04-29 6 mo ago modified 2026-07-24 3 mo ago also GHSA-f6pr-83pg-ghh6 , PYSEC-2026-2985 , EUVD-2026-28858
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration. This issue has been patched in version 0.23.3.
Patch / fix
- pypi pygeoapi 0.23.3
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pygeoapi | >=0.23.0, <0.23.3 |
0.23.3 |
Affected products
- geopython pygeoapi
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/geopython/pygeoapi/commit/bf25b8695edbdd5476eeffc102b633d1d3e45f52
web
-
github.com
/geopython/pygeoapi/security/advisories/GHSA-f6pr-83pg-ghh6
web
-
github.com
/geopython/pygeoapi/releases/tag/0.23.3
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-42351
advisory
-
github.com
/geopython/pygeoapi
package
-
pypi.org
/project/pygeoapi
package
-
github.com
/advisories/GHSA-f6pr-83pg-ghh6
advisory
Sources
- CVE List CVE-2026-42351
- GitHub Advisory GHSA-f6pr-83pg-ghh6
- NVD CVE-2026-42351
- OSV PYSEC-2026-2985
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.