CVE-2026-47754

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding `hasReadPermission()` check is commented out. An unauthenticated remote attacker can read any file accessible to the Tomcat process by sending a single GET request. Proof-of-concept exploits have been demonstrated and verified against this vulnerability, and it should be considered easily exploitable for any Metacat deployment < 3.0.0 by any user with access to the 1.x API. Through this vulnerability, production 2.x deployments are exposed to credential theft, client certificate and private key exfiltration enabling member node impersonation within the federation, embargoed research data disclosure, and broad system reconnaissance. Given Metacat's deployment footprint across the DataONE network of repositories and federally funded research programs, the population of exposed 2.x instances is non-trivial. The vulnerability was eliminated in Metacat version 3.0.0 and after by eliminating the entire Metacat 1.x API that exposed this vulnerability. The vulnerability was remediated in April 2024 with the release of Metacat 3.0.0, which removed the legacy Metacat API including ArchiveHandler.java. The commit message and issue reference architectural cleanup, not a security fix, and no advisory or CVE was issued. The 2.x branch was not and will not be backported, as is standard practice in Metacat, which only supports the most current release. 2.19.1 remains vulnerable with identical code and is beyond its supported lifetime. As a workaround, disable or restrict 1.x API servlets. Because the vulnerable 1.x API is no longer used or necessary in most Metacat deployments, restricting access to the old API endpoints can reduce or eliminate exposure for 2.19.x deployments. After removing those features, restart Tomcat or whichever software is hosting the servlets.

• CWE-22
• CWE-862

• https://github.com/NCEAS/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b
• https://github.com/NCEAS/metacat/issues/1365
• https://github.com/NCEAS/metacat/pull/1713
• https://github.com/NCEAS/metacat/security/advisories/GHSA-m852-f287-7cgw

Published

Aug 10, 2026

Last Modified

Aug 10, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47748stable-diffusion.cpp is a pure C/C++ library for running dif…5.5
• CVE-2026-47749stable-diffusion.cpp is a pure C/C++ library for running dif…7.8
• CVE-2026-4775A flaw was found in the libtiff library. A remote attacker c…7.8
• CVE-2026-47750stable-diffusion.cpp is a pure C/C++ library for running dif…7.8
• CVE-2026-47751Claude Code Action is a general-purpose GitHub action that r…5.3
• CVE-2026-47752Tugtainer is a self-hosted app for automating updates of Doc…9.9
• CVE-2026-47755ITFlow provides an IT documentation, ticketing and accountin…6.5
• CVE-2026-47759TinyMCE is an open source rich text editor. Prior to 5.11.1,…5.4
• CVE-2026-4776An SQL injection vulnerability exists in Mautic's API contac…7.1
• CVE-2026-47760TinyMCE is an open source rich text editor. From 6.8.0 to be…5.4
• CVE-2026-47761TinyMCE is an open source rich text editor. Prior to 5.11.1,…5.4
• CVE-2026-47762TinyMCE is an open source rich text editor. Prior to 5.11.1,…5.4