VULNERABILITY INTELLIGENCE

CVE-2026-42351

CVSS score7.5 HIGH
EPSS probability0.51%
CISA KEVNot currently listed
Published2026-05-08
Last modified2026-07-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration. This issue has been patched in version 0.23.3.

Weakness classification

  • security-advisories@github.com: CWE-22

Primary references