What is the CVSS score of CVE-2026-42351?

CVE-2026-42351 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of pygeoapi are affected by CVE-2026-42351?

pygeoapi versions 0.23.0 through 0.23.2 contain a directory traversal vulnerability allowing unauthenticated remote attackers to read arbitrary files from affected systems when STAC collection…. A patch is available.

How to fix or mitigate CVE-2026-42351?

Within 24 hours, inventory all instances of pygeoapi versions 0.23.0 through 0.23.2 across production and staging environments by checking application version strings, container images, and package management systems. Within 7 days, apply the vendor-released patch by upgrading all affected systems to the latest patched version available from the pygeoapi project; as an interim measure if patching is delayed, immediately deploy a URL-normalizing reverse proxy (such as nginx with merge_slashes enabled or Apache with AllowEncodedSlashes off) in front of pygeoapi instances. Within 30 days, conduct a file-access audit on previously affected systems by reviewing server access logs for requests containing '..' sequences since the vulnerability disclosure date, confirm no unauthorized file reads occurred, and validate all STAC collection resources are running patched code.

pygeoapi CVE-2026-42351

HIGH

Path Traversal (CWE-22)

2026-04-29 https://github.com/geopython/pygeoapi

GHSA-f6pr-83pg-ghh6

Path Traversal

7.5

CVSS 3.1 · Vendor: https://github.com/geopython/pygeoapi

Severity by source

Vendor (https://github.com/geopython/pygeoapi) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated traversal (AV:N/PR:N/UI:N) exposing directory contents yields C:H with no integrity or availability impact; kept AC:L since the '..' request is trivial once the required stac-collection config is present.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/geopython/pygeoapi).

CVSS VectorVendor: https://github.com/geopython/pygeoapi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 01:22 vuln.today

Analysis Generated

Jul 24, 2026 - 01:22 vuln.today

Patch released

Apr 29, 2026 - 22:30 nvd

Patch available

CVE Published

Apr 29, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Impact

A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration.

Patches

The issue has been patched in master branch and made available as part of the 0.23.3 release.

The commit/fix can be found in bf25b8695edbdd5476eeffc102b633d1d3e45f52.

Workarounds

Users can safeguard existing applications by disabling STAC collection based resources in their pygeoapi config, until 0.23.3 can be installed and deployed.

AnalysisAI

Directory exposure in pygeoapi's STAC FileSystemProvider (versions 0.23.0 through 0.23.2) lets remote unauthenticated attackers read arbitrary directories on the server by supplying '..' traversal sequences in requests to a stac-collection resource. The flaw stems from raw string path concatenation and only surfaces when pygeoapi is deployed without a URL-normalizing proxy and a stac-collection resource is configured. There is no public exploit identified at time of analysis and EPSS is low (0.09%), but exploitation is trivial (AV:N/AC:L/PR:N) wherever the preconditions hold.

Technical ContextAI

pygeoapi is a Python (pkg:pip/pygeoapi) implementation of OGC API standards for serving geospatial data, including SpatioTemporal Asset Catalog (STAC) endpoints. The affected component is the STAC FileSystemProvider plugin (pygeoapi/provider/filesystem.py), which maps incoming URL path segments to files on disk to serve STAC collection assets. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): get_data_path() built the on-disk target via os.path.join(self.data, dirpath) using the raw, un-sanitized request path. Because no normalization or '..' rejection was applied, an attacker-supplied dirpath containing '..' resolves outside the intended data root, exposing parent directories. The patched code adds an explicit check that raises ProviderInvalidQueryError whenever '..' appears in dirpath, as confirmed by the commit diff and the added test asserting rejection of '../../poi_portugal'.

RemediationAI

Vendor-released patch: upgrade to pygeoapi 0.23.3, which adds explicit rejection of paths containing '..' in the STAC FileSystemProvider (commit bf25b8695edbdd5476eeffc102b633d1d3e45f52). Until 0.23.3 can be installed, the vendor-recommended workaround is to disable STAC collection based resources (remove or comment out any 'stac-collection' type resources) in the pygeoapi configuration; the trade-off is that STAC filesystem catalog endpoints become unavailable to legitimate users. As an additional compensating control, place pygeoapi behind a reverse proxy or web front end (nginx, Apache httpd, or Traefik) that normalizes URLs and collapses '..' sequences before they reach the application, which neutralizes the traversal without disabling functionality. Refer to the advisory at https://github.com/geopython/pygeoapi/security/advisories/GHSA-f6pr-83pg-ghh6 and the patch commit at https://github.com/geopython/pygeoapi/commit/bf25b8695edbdd5476eeffc102b633d1d3e45f52.