CVE-2026-42351

HighCVSS 7.5

Published: 08/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

40th percentile - higher than 40% of all known CVEs

Summary

pygeoapi versions 0.23.0 through 0.23.2 have a path concatenation vulnerability in the STAC FileSystemProvider plugin. Lack of URL normalization may allow unauthenticated access to directories when deployed without a proxy that normalizes '..' in URLs.

Risk Assessment

An unauthenticated attacker could access files and directories outside the intended scope, leading to data disclosure.

Recommendation

Upgrade pygeoapi to version 0.23.3, which contains the fix.

Other vulnerabilities in pygeoapi

CVE-2026-42352High
Pygeoapi versions 0.23.0 through 0.23.3 have a vulnerability that allows using the subscriber object to make requests to internal HTTP services during OGC API process execution. This issue is fixed in version 0.23.3.

Original NVD description (English source)

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration. This issue has been patched in version 0.23.3.