Unauthenticated path traversal in Metacat 2.x (CVE-2026-47754)

Metacat versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal vulnerability in the `archiveEntryName` parameter of the `action=read` endpoint of the legacy 1.x API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding permission check is commented out. An unauthenticated remote attacker can read any file accessible to the Tomcat process with a single GET request, exposing credentials, private keys, embargoed research data, and enabling member node impersonation within the DataONE federation. Affected versions: - <= 2.19.1 We recommend updating to: >= 3.0.0. CVSS 9.3 · our assessment: act_now Reference: https://github.com/NCEAS/metacat/security/advisories/GHSA-m852-f287-7cgw Details: https://vuln.today/cve/CVE-2026-47754