7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42351

CVE-2026-42351: pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider

Impact

A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration.

Patches

The issue has been patched in master branch and made available as part of the 0.23.3 release.

The commit/fix can be found in bf25b8695edbdd5476eeffc102b633d1d3e45f52.

Workarounds

Users can safeguard existing applications by disabling STAC collection based resources in their pygeoapi config, until 0.23.3 can be installed and deployed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42351

CVE-2026-42351:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pygeoapi	pip	>= 0.23.0, < 0.23.3	0.23.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit bf25b8695edbdd5476eeffc102b633d1d3e45f52 clearly indicates a path traversal vulnerability within the pygeoapi.provider.filesystem.FileSystemProvider class. The patch directly modifies the get_data_path method to add a security check. Specifically, the code change from data_path = os.path.join(self.data, dirpath) to an explicit check if '..' in dirpath: demonstrates that the dirpath parameter was not being properly sanitized. This allowed an attacker to use '..' sequences to navigate the file system and access arbitrary files. The vulnerable function is FileSystemProvider.get_data_path as it is responsible for constructing the path and was the location of the insecure code. The added test case in the patch further confirms that this function was the entry point for the vulnerability.

Vulnerable functions

FileSystemProvider.get_data_path

pygeoapi/provider/filesystem.py

The function `get_data_path` in the `FileSystemProvider` class was vulnerable to path traversal. The original code used `os.path.join(self.data, dirpath)` to construct a file path. If an attacker provided a `dirpath` containing '..', they could access files and directories outside of the intended base directory specified by `self.data`. The patch mitigates this by explicitly checking for '..' in the `dirpath` and raising an error if found, preventing the traversal.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.