CVE-2026-48114

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.

• CWE-89
• CWE-287

• https://github.com/NCEAS/metacat/commit/820d595309b399fdbdf4983bd1b1dd795773472a
• https://github.com/NCEAS/metacat/security/advisories/GHSA-wrc6-rc34-hrcg

Published

Jun 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48109MessagePack for C# is a MessagePack serializer for C#. Prior…8.2
• CVE-2026-4811The WPB Floating Menu & Categories for WordPress – Sticky Si…4.9
• CVE-2026-48110Russh is a Rust SSH client & server library. From version 0.…7.5
• CVE-2026-481117-Zip is a file archiver with a high compression ratio. Vers…7.1
• CVE-2026-481127-Zip is a file archiver with a high compression ratio. Vers…6.5
• CVE-2026-48113Chisel is a TCP/UDP tunnel, transported over HTTP and secure…8.5
• CVE-2026-48115Misskey is an open source, federated social media platform. …6.3
• CVE-2026-48116AnythingLLM is an application that turns pieces of content i…8.8
• CVE-2026-48117DroneAware is a drone detection platform. The centralized Dr…6.8
• CVE-2026-48119Nezha Monitoring is a self-hostable, lightweight, servers an…7.1
• CVE-2026-4812The Advanced Custom Fields (ACF) plugin for WordPress is vul…5.3
• CVE-2026-48120Kakoune is a code editor. Prior to version 2026.05.21, the b…8.6