p PatchFirst

CVE-2026-42351

CVE-2026-42351 · pygeoapi: Path Traversal in STAC FileSystemProvider

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration. This issue has been patched in version 0.23.3.

CVSS 7.5 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • pygeoapi

    Versions
    • >= 0.23.0, < 0.23.3: Affected

    No fix published

  • pygeoapi PyPI

    Versions
    • 0.23.0
    • 0.23.1
    • 0.23.2
    Affected ranges
    • ECOSYSTEM: ≥ 0.23.0, < 0.23.3

    Update to 0.23.3

Original sources

Check your server →