Metacat vulnerabilities
3 known CVE vulnerabilities in Metacat, translated and rated.
- CVE-2026-48528Critical
Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints. The `nodeId` parameter is unsanitized and concatenated into SQL queries, allowing attackers to execute arbitrary SQL, including reading, modifying, and deleting data from the PostgreSQL database. SQL errors are reflected in XML messages, enabling data exfiltration.
- CVE-2026-47754Critical
Metacat versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint in the legacy 1.x API. An attacker can read any file accessible to the Tomcat process by sending a single GET request, as path validation is missing and the permission check is commented out.
- CVE-2026-48114Critical
Metacat is data repository software that contains an unauthenticated SQL injection vulnerability in the /harvesterRegistration endpoint in versions 2.0.0 and above. Exploiting this vulnerability allows full read/write/execute access in the Metacat database context.