CVE-2026-47754

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47754", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T22:16:39.505Z", "datePublished": "2026-08-10T15:26:03.526Z", "dateUpdated": "2026-08-10T18:11:11.513Z"}, "containers": {"cna": {"title": "unauthenticated path traversal in Metacat 2.x", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/NCEAS/metacat/security/advisories/GHSA-m852-f287-7cgw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NCEAS/metacat/security/advisories/GHSA-m852-f287-7cgw"}, {"name": "https://github.com/NCEAS/metacat/issues/1365", "tags": ["x_refsource_MISC"], "url": "https://github.com/NCEAS/metacat/issues/1365"}, {"name": "https://github.com/NCEAS/metacat/pull/1713", "tags": ["x_refsource_MISC"], "url": "https://github.com/NCEAS/metacat/pull/1713"}, {"name": "https://github.com/NCEAS/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b", "tags": ["x_refsource_MISC"], "url": "https://github.com/NCEAS/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b"}], "affected": [{"vendor": "NCEAS", "product": "metacat", "versions": [{"version": "< 3.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T15:26:03.526Z"}, "descriptions": [{"lang": "en", "value": "Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding `hasReadPermission()` check is commented out. An unauthenticated remote attacker can read any file accessible to the Tomcat process by sending a single GET request. Proof-of-concept exploits have been demonstrated and verified against this vulnerability, and it should be considered easily exploitable for any Metacat deployment < 3.0.0 by any user with access to the 1.x API. Through this vulnerability, production 2.x deployments are exposed to credential theft, client certificate and private key exfiltration enabling member node impersonation within the federation, embargoed research data disclosure, and broad system reconnaissance. Given Metacat's deployment footprint across the DataONE network of repositories and federally funded research programs, the population of exposed 2.x instances is non-trivial. The vulnerability was eliminated in Metacat version 3.0.0 and after by eliminating the entire Metacat 1.x API that exposed this vulnerability. The vulnerability was remediated in April 2024 with the release of Metacat 3.0.0, which removed the legacy Metacat API including ArchiveHandler.java. The commit message and issue reference architectural cleanup, not a security fix, and no advisory or CVE was issued. The 2.x branch was not and will not be backported, as is standard practice in Metacat, which only supports the most current release. 2.19.1 remains vulnerable with identical code and is beyond its supported lifetime. As a workaround, disable or restrict 1.x API servlets. Because the vulnerable 1.x API is no longer used or necessary in most Metacat deployments, restricting access to the old API endpoints can reduce or eliminate exposure for 2.19.x deployments. After removing those features, restart Tomcat or whichever software is hosting the servlets."}], "source": {"advisory": "GHSA-m852-f287-7cgw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T18:10:55.286374Z", "id": "CVE-2026-47754", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T18:11:11.513Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47754", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T18:10:55.286374Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T18:11:01.009Z"}}], "cna": {"title": "unauthenticated path traversal in Metacat 2.x", "source": {"advisory": "GHSA-m852-f287-7cgw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "NCEAS", "product": "metacat", "versions": [{"status": "affected", "version": "< 3.0.0"}]}], "references": [{"url": "https://github.com/NCEAS/metacat/security/advisories/GHSA-m852-f287-7cgw", "name": "https://github.com/NCEAS/metacat/security/advisories/GHSA-m852-f287-7cgw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/NCEAS/metacat/issues/1365", "name": "https://github.com/NCEAS/metacat/issues/1365", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/NCEAS/metacat/pull/1713", "name": "https://github.com/NCEAS/metacat/pull/1713", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/NCEAS/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b", "name": "https://github.com/NCEAS/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding `hasReadPermission()` check is commented out. An unauthenticated remote attacker can read any file accessible to the Tomcat process by sending a single GET request. Proof-of-concept exploits have been demonstrated and verified against this vulnerability, and it should be considered easily exploitable for any Metacat deployment < 3.0.0 by any user with access to the 1.x API. Through this vulnerability, production 2.x deployments are exposed to credential theft, client certificate and private key exfiltration enabling member node impersonation within the federation, embargoed research data disclosure, and broad system reconnaissance. Given Metacat's deployment footprint across the DataONE network of repositories and federally funded research programs, the population of exposed 2.x instances is non-trivial. The vulnerability was eliminated in Metacat version 3.0.0 and after by eliminating the entire Metacat 1.x API that exposed this vulnerability. The vulnerability was remediated in April 2024 with the release of Metacat 3.0.0, which removed the legacy Metacat API including ArchiveHandler.java. The commit message and issue reference architectural cleanup, not a security fix, and no advisory or CVE was issued. The 2.x branch was not and will not be backported, as is standard practice in Metacat, which only supports the most current release. 2.19.1 remains vulnerable with identical code and is beyond its supported lifetime. As a workaround, disable or restrict 1.x API servlets. Because the vulnerable 1.x API is no longer used or necessary in most Metacat deployments, restricting access to the old API endpoints can reduce or eliminate exposure for 2.19.x deployments. After removing those features, restart Tomcat or whichever software is hosting the servlets."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T15:26:03.526Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47754", "state": "PUBLISHED", "dateUpdated": "2026-08-10T18:11:11.513Z", "dateReserved": "2026-05-19T22:16:39.505Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-10T15:26:03.526Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "metacat", "vendor": "NCEAS", "versions": [{"status": "affected", "version": "< 3.0.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding `hasReadPermission()` check is commented out. An unauthenticated remote attacker can read any file accessible to the Tomcat process by sending a single GET request. Proof-of-concept exploits have been demonstrated and verified against this vulnerability, and it should be considered easily exploitable for any Metacat deployment < 3.0.0 by any user with access to the 1.x API. Through this vulnerability, production 2.x deployments are exposed to credential theft, client certificate and private key exfiltration enabling member node impersonation within the federation, embargoed research data disclosure, and broad system reconnaissance. Given Metacat's deployment footprint across the DataONE network of repositories and federally funded research programs, the population of exposed 2.x instances is non-trivial. The vulnerability was eliminated in Metacat version 3.0.0 and after by eliminating the entire Metacat 1.x API that exposed this vulnerability. The vulnerability was remediated in April 2024 with the release of Metacat 3.0.0, which removed the legacy Metacat API including ArchiveHandler.java. The commit message and issue reference architectural cleanup, not a security fix, and no advisory or CVE was issued. The 2.x branch was not and will not be backported, as is standard practice in Metacat, which only supports the most current release. 2.19.1 remains vulnerable with identical code and is beyond its supported lifetime. As a workaround, disable or restrict 1.x API servlets. Because the vulnerable 1.x API is no longer used or necessary in most Metacat deployments, restricting access to the old API endpoints can reduce or eliminate exposure for 2.19.x deployments. After removing those features, restart Tomcat or whichever software is hosting the servlets."}, {"lang": "es", "value": "Metacat es un software de repositorio de datos que ayuda a los investigadores a preservar, compartir y descubrir datos. Las versiones 2.x hasta la 2.19.1 y todas las versiones 1.x contienen un salto de ruta no autenticado en el par\u00e1metro \u2019archiveEntryName\u2019 del endpoint \u2019action=read\u2019 que forma parte de la API 1.x original de Metacat. \u2019ArchiveHandler.readArchiveEntry()\u2019 concatena el par\u00e1metro proporcionado por el usuario en una ruta del sistema de archivos sin validaci\u00f3n, y la verificaci\u00f3n circundante \u2019hasReadPermission()\u2019 est\u00e1 comentada. Un atacante remoto no autenticado puede leer cualquier archivo accesible para el proceso de Tomcat enviando una \u00fanica solicitud GET. Se han demostrado y verificado exploits de prueba de concepto contra esta vulnerabilidad, y debe considerarse f\u00e1cilmente explotable para cualquier implementaci\u00f3n de Metacat anterior a 3.0.0 por cualquier usuario con acceso a la API 1.x. A trav\u00e9s de esta vulnerabilidad, las implementaciones de producci\u00f3n 2.x est\u00e1n expuestas a robo de credenciales, exfiltraci\u00f3n de certificados de cliente y claves privadas lo que permite la suplantaci\u00f3n de nodos miembros dentro de la federaci\u00f3n, divulgaci\u00f3n de datos de investigaci\u00f3n embargados y reconocimiento amplio del sistema. Dada la huella de implementaci\u00f3n de Metacat en la red de repositorios DataONE y los programas de investigaci\u00f3n financiados con fondos federales, la poblaci\u00f3n de instancias 2.x expuestas no es trivial. La vulnerabilidad fue eliminada en la versi\u00f3n 3.0.0 de Metacat y posteriores al eliminar toda la API 1.x de Metacat que expon\u00eda esta vulnerabilidad. La vulnerabilidad fue remediada en abril de 2024 con el lanzamiento de Metacat 3.0.0, que elimin\u00f3 la API heredada de Metacat, incluyendo ArchiveHandler.java. El mensaje de commit y el problema hacen referencia a una limpieza arquitect\u00f3nica, no a una correcci\u00f3n de seguridad, y no se emiti\u00f3 ning\u00fan aviso o CVE. La rama 2.x no fue ni ser\u00e1 retroportada, como es pr\u00e1ctica est\u00e1ndar en Metacat, que solo soporta la versi\u00f3n m\u00e1s actual. La 2.19.1 sigue siendo vulnerable con c\u00f3digo id\u00e9ntico y est\u00e1 m\u00e1s all\u00e1 de su vida \u00fatil soportada. Como soluci\u00f3n alternativa, deshabilite o restrinja los servlets de la API 1.x. Debido a que la API 1.x vulnerable ya no se usa o es necesaria en la mayor\u00eda de las implementaciones de Metacat, restringir el acceso a los antiguos endpoints de la API puede reducir o eliminar la exposici\u00f3n para las implementaciones 2.19.x. Despu\u00e9s de eliminar esas caracter\u00edsticas, reinicie Tomcat o cualquier software que est\u00e9 alojando los servlets."}], "id": "CVE-2026-47754", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47754", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T18:10:55.286374Z", "version": "2.0.3"}}]}, "published": "2026-08-10T16:19:47.797", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/NCEAS/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b"}, {"source": "security-advisories@github.com", "url": "https://github.com/NCEAS/metacat/issues/1365"}, {"source": "security-advisories@github.com", "url": "https://github.com/NCEAS/metacat/pull/1713"}, {"source": "security-advisories@github.com", "url": "https://github.com/NCEAS/metacat/security/advisories/GHSA-m852-f287-7cgw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "metacat", "source": "cna", "vendor": "NCEAS"}, "product": "metacat", "vendor": "nceas"}], "created": "2026-08-10T18:00:03.743357+00:00", "updated": "2026-08-11T04:30:03.048679+00:00", "vendors": ["nceas", "nceas$PRODUCT$metacat"]}