{"id":"CVE-2026-47754","summary":"unauthenticated path traversal in Metacat 2.x","details":"Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding `hasReadPermission()` check is commented out. An unauthenticated remote attacker can read any file accessible to the Tomcat process by sending a single GET request. Proof-of-concept exploits have been demonstrated and verified against this vulnerability, and it should be considered easily exploitable for any Metacat deployment \u003c 3.0.0 by any user with access to the 1.x API. Through this vulnerability, production 2.x deployments are exposed to credential theft, client certificate and private key exfiltration enabling member node impersonation within the federation, embargoed research data disclosure, and broad system reconnaissance. Given Metacat's deployment footprint across the DataONE network of repositories and federally funded research programs, the population of exposed 2.x instances is non-trivial. The vulnerability was eliminated in Metacat version 3.0.0 and after by eliminating the entire Metacat 1.x API that exposed this vulnerability. The vulnerability was remediated in April 2024 with the release of Metacat 3.0.0, which removed the legacy Metacat API including ArchiveHandler.java. The commit message and issue reference architectural cleanup, not a security fix, and no advisory or CVE was issued. The 2.x branch was not and will not be backported, as is standard practice in Metacat, which only supports the most current release. 2.19.1 remains vulnerable with identical code and is beyond its supported lifetime. As a workaround, disable or restrict 1.x API servlets. Because the vulnerable 1.x API is no longer used or necessary in most Metacat deployments, restricting access to the old API endpoints can reduce or eliminate exposure for 2.19.x deployments.  After removing those features, restart Tomcat or whichever software is hosting the servlets.","aliases":["GHSA-m852-f287-7cgw"],"modified":"2026-10-28T11:01:11.330834881Z","published":"2026-08-10T15:26:03.526Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47754.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-22","CWE-862"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47754.json"},{"type":"ADVISORY","url":"https://github.com/NCEAS/metacat/security/advisories/GHSA-m852-f287-7cgw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47754"},{"type":"REPORT","url":"https://github.com/NCEAS/metacat/issues/1365"},{"type":"FIX","url":"https://github.com/NCEAS/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b"},{"type":"FIX","url":"https://github.com/NCEAS/metacat/pull/1713"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nceas/metacat","events":[{"introduced":"0"},{"fixed":"08cde6eaf2c5b075f3eb16d8e9096aee6eb3739e"},{"fixed":"07e034b2bbf7029e28af32f472f4d70ea6b5ab1b"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"3.0.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"07e034b2bbf7029e28af32f472f4d70ea6b5ab1b"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["chart-2.1.3","chart-2.1.2","3.2.2","chart-2.1.1","chart-2.1.0","3.2.1","chart-2.0.0","3.2.0","chart-1.2.0","3.1.0","chart-1.1.1","chart-1.1.0","3.0.0","2.19.1","2.19.0","2.18.0","2.17.0","2.16.2","2.16.1","2.16.0","2.15.1","2.15.0","2.14.1","2.14.0","2.13.0","2.12.4","2.12.3","2.12.2","2.12.1","2.12.0","2.11.1","2.11.0","2.11.0-rc1","2.10.4","2.10.3","2.10.2","2.10.1","2.10.0","2.9.0","2.8.7","2.8.6","METACAT_2_8_5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47754.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b","target":{"file":"src/edu/ucsb/nceas/metacat/ArchiveHandler.java","function":"readArchiveEntry"},"deprecated":false,"digest":{"function_hash":"285143335496464489789257024810608891302","length":2798},"id":"CVE-2026-47754-10394700","signature_type":"Function"},{"digest":{"function_hash":"178193955275797008942401210031592342470","length":137},"id":"CVE-2026-47754-19a9fa2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b","target":{"function":"getInstance","file":"src/edu/ucsb/nceas/metacat/ArchiveHandler.java"},"deprecated":false},{"source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b","target":{"file":"src/edu/ucsb/nceas/metacat/MetacatHandler.java"},"deprecated":false,"digest":{"line_hashes":["79756184691986397811230402474395037923","218963842084514407001062643896224372001","121046956851855738054779073336316770770","74677600449828144827341178732322967839"],"threshold":0.9},"id":"CVE-2026-47754-1c2807f2","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["45693621269846074763864902671808319236","45797754901170964316206694747342093985","178611873243548537079774605772806958649","322753518022243009375003437154653249291","302038283130373420524966322569568195280","9771703354826507298523245046694676323","190829608644444330660996901469758947134","261654530989218604486547073985443224471","78826028314833835562141171225295195186","166032442369155052237668663670158944010","133294270522893997597233896461546064251","49401234144910551238994440182125168657","71327194829912624053577967039606326826","332757899931886655602491642495888115435","235746594348812681928984034380322440774","243882559848604447592384161809334302382","222654809026499460654689009455867140316","101555136375938382417978180292051898264","287842866483324654094831207400176560213","194791999951626474934844359748376757160","332937871717107282321460165387527530727","275277123120384285295857072964909223905","183139084317952241877646948060711709334","151459249743050228810726144987276300566","215252307972779697521115446137999911666","80593547352463057102427572917800792907","50269477787571978550443980022952124374","104679138042532784709465775420872655216","251182935057915418867422498998658563217","222959660592709520261682101979324732980","315041750520637730278687102459188463161","131241885790620390478347155794258091389","167219311484087600199094286638315115238","233416576192459160035808795427895565460","287416032945873081242745601518208052778","307826635180386263036417820378134904750","84926973637135565959061956444647408126","267751585180237014726969168826895902808","88824343537338102555576136334893152608","44847203628492767590604996083194694488","251939729814482466404743756165031945069","241068629693051662175726130302525467957","103780092092684761027307684238804830780","132371687238730436088718856384731704442","117913314369920233313974508215017137398","182035654095601096961727767354923374317","148424575991933508284362327702679784282","130629253631934514557923185067890957172","318532821783084522419307622426705004774","37252707426656215772922279539153964228","324635886795007428570451999212761652695","26605948711632069968140070633514471328","311632743901425759492984068829852487873","135728831993714321281437179197198131495","73375678359202642126997997066359426596","74388347130907957860683214289004444085","123073236169479345633369460810500733190","174150806599072375701101047370204793071","90433350847335385317439903120634072088","176887403117884933633827788345227658643","30326967111573482592866814897776288346","191779460640408730685481313652440171856","44968899490696805252786124148209177978","48683892799109201780260004147168441205","258858471322674504171679622563311846063","14572936355220897955392082418881248309","38177810823888507341482562425349295219","146380323973566804405186193932028050181","145460661643131685532333761525227595664","327068642769446863532010605274675961051","130784201722783460165783083484262289574","150799223605900084822550006792452498203","326986957236641814323865648435505789821","326202685858173046819506217002088578420","256281226431755550788607200530782227247","123448509823936045208002566815132603400","34378476273340102284969851744674739855","308606333233590980447597069091643845890","114564618415989474458377323558524431331","292882141300294683351397350842770222594","270044720545009795288584573398128845672","17657035454722935945420570372773852810","240362408040196054199749668432446434417","256303665184228165295238066558770686761","200586188582779526936016690804556332533","231698268351163354228804231769168331610","56952663804053504513801977912658553582","299415538068484426755403251997130226551","232876530206234008624345164215471165856","161177564856773370801080228042092866382","246943759775682596618365255660286459392","73604334746712095694446382465513027604","143346115864390520963020856326476627407","303863218581158531956222842801686788463"]},"id":"CVE-2026-47754-1ca69ba3","signature_type":"Line","signature_version":"v1","source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b","target":{"file":"src/edu/ucsb/nceas/metacat/ArchiveHandler.java"}},{"deprecated":false,"digest":{"function_hash":"256925658113551489168482653691227261005","length":1821},"id":"CVE-2026-47754-3d2f52bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b","target":{"file":"src/edu/ucsb/nceas/metacat/util/DocumentUtil.java","function":"isAuthorized"}},{"target":{"file":"src/edu/ucsb/nceas/metacat/MetaCatServlet.java","function":"checkIndexPaths"},"deprecated":false,"digest":{"function_hash":"52690120883519584860733311578146486061","length":4437},"id":"CVE-2026-47754-418112ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b"},{"target":{"file":"src/edu/ucsb/nceas/metacat/MetaCatServlet.java","function":"handleGetOrPost"},"deprecated":false,"digest":{"function_hash":"208259471693092141809753307981215953947","length":13406},"id":"CVE-2026-47754-63139279","signature_type":"Function","signature_version":"v1","source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b"},{"deprecated":false,"digest":{"line_hashes":["26531704777631859878245038832373912127","200142320756099012182110398043794380989","196457595530760634048204070972124552326","91902361772112935827405261481812689591","71617330234501001726262486165306655127","266502775667351876133101763472640923728","310147709070000886520629313018893267571","24236416386078901011620427304843751626","150607005829468496345500128015013654316","135455949338912897589856694552870394478","207690212494900352943180403487252246010","62138863800233978840442316851930932117","190905466282272947603576483377473647059","226062465128034135430763088529017485306","16242174926771834047299221539326465240","98905923156213313831406934906179137847","59749822820697351105163984234274738678","155771787127713451724466211326188024906","321925112506636192461646881333289298780","281054176513014171756730967572755954228","308501601579194894696286451577916518426","234629231504336086041415191936724200947","288659066448517073902807318046006424653","174398177485400714935648523688748088765","252278421821964317675802755235785432161","33135999055680166675366790151316443788","205401591638468275693677544248508627820","114083669369184781740810306278923661693","228347926372644065144755581010722572725","325578304857724679665052213211054888704","214284918598343688527657364904131094533","234388975926928090467079937220502371324","108544927160858694368127475033615037052","267893904472166303271906260089323448453","117398798105835269837593674662606530140","302780099298184884556013689237367639880","119560655692007468166200708040961694007","34899565140583677301486157126819274140","94479993916041541695397545287574427050","42315194591817497409122982703362325239","26472688846594629735668318230165127000","119633052985045356202084284906731194054","136792058230384847362677901340747222055","162737327573536441827985541222416031528","139988210894226352070190914634259825516","101040614901535057651946511642389583151","210909729379349272314828158400437120377","274796333045668716151314896553826285925","244128868699530410503728165739424547043","1387200847054763878027732261757700997","148001303482713252433178507298758126610","116722235922009618754722676169938224362","279746729869477714893340304113749228816","290104835488264125373143263875994695935","110872312029479796922676735036793584481","170436767277522236229922478026869140307","234838949177089621061139666281730340953"],"threshold":0.9},"id":"CVE-2026-47754-e65a1bd8","signature_type":"Line","signature_version":"v1","source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b","target":{"file":"src/edu/ucsb/nceas/metacat/util/DocumentUtil.java"}},{"digest":{"line_hashes":["20851561563452642088164150306629156247","53459542154380143649391164598610067210","295158341858616795574215731173402450021","241107635320999670754627068318867336036","52280164223711512129352870064852768755","144663241893033172320832133364545550163","269576929825079533975264238800668039213","70496493018028242280369591023243630090","276644996305069624735168051079573429395","66664060004070175250918027600486135992","177691681732664185324929443598647344014","90700810559161156731304487707386649058","206525341908292839355790064367357049644","226902765428206865842305147657561321674","21342122249212824183413040618177614115","48318164778896272524842710979221934889","332564495864323925847519890372702455361","228015306605201168299615901578037061306","268619837384182416036193759246183901355","17116061071889413784606010267642265925","43492495420090201604593266503439341200","100002240132163133655266411838007215347","238617125830716281926149122334746733240","255841430953251491005828920693003798507","287421589620023001946103373216878466031","236852739036358388546276275032502214686","250568423993369429820403445119713605045","37527266155965520476164523173050170567","22691499700661235966408150034950574370","310518454197185952936924304605623643378","306024788850881784803024463570116120482","217008760542476766037638804977699133643","112435178567766064872810691838915935735","106387237948219503133510201117043544301","130796661334026729252620463529918962943","233486244412398661002925865660314934719","335152298492764489634359205384118222266","8522075372533611385156023431507703382","15755385011950744916683698547681609108","3038113509323416968544321864487658028","200236526342314973523212298831871121359","308131782795736959402795901209956582063","227922417257756896091262818369934759051","231411812444253288433128142821037554344","102374718132846969923033256126313474857","339688448578103959436352794354515544340","333051883763511864115716444675825365853","1073803871512271013052930354492557544","318616073351358706297166762481246227417","261966134936374866049896985314645618151","333216241601934432781716695071020178305","37160119850451983654024813397143936661","217349594678812930868449776651268389341","8935243149459575992974852065907525950","288277493176185691913433946078339824542","216226629691210857364639223146039153243","168854110677268829185534274467053201110","336817747823071708975323112676012464099","264434510845237583011429472099546276258","151208298719022103992736111088709360006","20006288212914207490384786835896447858","45432229797423801852350556600227182252","213109252714554257800420392843864717097","318769595142829354008733011520525143437","76545466341086324380359417934189882302","337029900297379691915139735377684762234","132835170465828947499865520256055649346","299616308788369944399425164530214554213","303093174705302192892652107127992476631","319463742608033446538214524090754275022","259676129171765075606607544838452841699","310168229565814164896001553801335771304","57967254387069233301163370143405319605","61947569108391345552658400388765664236","221897914894477211689704167317822168598","23077545616829047064887001908158623213","115370921521189918896100646174765648910","306849142595691799015138448259405585336","469795728816107971443796848977677321","120562275432055777721453044348172771946","244262263163081959759892582077963667852","311438760123959768334428048160451078040","92980081256600239427772992301530023262","149879095808292041329391750856098826671","133598376940585571134461197140393868689","246969897911835948582046783479220020247","221324931330180384721065745053944567588","56972494583716923176658723611240462477","124537326913879650554176708569375407857","163142794707743994748667527341487594334","38936911985249227692441437214303705619","287886053241981233650083803852295601323","264502152652933276094506355480103196859","173870499410557811048766597083434091628","217892775497841663539539787117391645910","56359311493209312007447211409595729921","313071038150497299277050807401677209705","124043370107553597001381427879338295519","279594224453382496199457857041730914942","101319159025145001960853506318622774089","283570005478941366067433096606530018053","212505873133226178944592912122996931524","191033996092573105494466318888780701957","39535650055913515358319405853920811526","77812875789741382711589816021876824100","267548839315549689688174389029396792440","293186808528300814078938177829665173455","18013121019610131123421866449991590939","243359159704424816734700734390626906568","50406264265735672942171712186912274465","261704485444707919854718650997895138936","123918942304590739239210609876095770779","229338680840785236407213321388399176609","322766410903796002331332295691488082869","58832077111249082945515067322907916352","194668583642982956819613225097322776507","197879208877521015684195358032136311024","50406264265735672942171712186912274465","217932768325359786515693869935352808242","24975358728921253055405355200552586661","292411868643571623061874825561041902687","331900406288061106211649718898539653261","281971997808397214557656666822831473703","93082221638391063854382715637500805471","241736931117140139750358037439485679050","224970547220219364443227568054312982117","293924033890400883196905329502471914405","36650399650378012719659746224648355955","3027832304596258167596804598531867532","204292898666065850290657549418792027977","285482877308380221092780753032382529209","159234875801886667482197269319501534259","26607590042888209033099742853754747308","148288996728655997055862193392104007870","209830772414865696827506839783027310272","44850690154901256893963354767372896091","240833061473696118370390018805127330067","258690934543473185738755501157976124192","315339852464026531201799169367965275653","136744362373399881553135486411002910437","296247075086350711862724880489368993161","77638364536071655127749574049129672797","36304541303455002149783795050333369065","254995465355979287797232432383573343167","205497111377098189256180805640084319920","153389287423365817416617142913157652085","3697276500171257718852880931709154126","310138381776912947856980850887850445392","39022223450778106027757890309350599195","200910454812602347964722274483438211750","126666751415389734032580792367326270064","190568648509036788057265140321889863809","85588060975247349711995926437725200103","58876586112561863147987788840924899773","27031251267948227768721848255989756124","297093881780010824946975941432566954047","171683415735657090344908207157528080424","200343765743006684560996562582778844729","21441900835533215699806990277545962589","291503588707644615529077407648673231058","323285010216809906700513316415760554599","190948071343739056205211927417094389837","111532201696183395342562526792591826472","301623197292796450701443913251621876972","267750507709996198635038124573754022911","1247782343782089406038732028018738746","263844483115638646611023875980058156054","302966407768342006159818056463859134430","267720628797405735520388384565886120199","5106471481154868476703925283430982028","116801898300483595581382032338910786607","311987294592102050201138986120592958943","308189275052304423335153325616894880177","33956117940414851439324734368372589563","246615261420510645905631525313216435658","101310989824627221841306610632046096454","276433852739891648960783024517601643360","99202777075042906866907023121655702372","269793133495631407817456318358486820424","224519366654519596657996728108078617849","91091024704300162013540477954153077777","333468137028124195110506545887396607291","197749288316829696965891939226032016660","65094975111600800928462306696389314337","123694847603241799164827798561317339988","270767346525684612231125222032916482875","91280187102346230613165632180134661574","204710897947034289811209221486141395588"],"threshold":0.9},"id":"CVE-2026-47754-e67024e1","signature_type":"Line","signature_version":"v1","source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b","target":{"file":"src/edu/ucsb/nceas/metacat/MetaCatServlet.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/nceas/metacat/commit/07e034b2bbf7029e28af32f472f4d70ea6b5ab1b","target":{"file":"src/edu/ucsb/nceas/metacat/ArchiveHandler.java","function":"ArchiveHandler"},"deprecated":false,"digest":{"function_hash":"174695926934190054880799744227881365221","length":40},"id":"CVE-2026-47754-fc3bf9b7","signature_type":"Function"}],"vanir_signatures_modified":"2026-10-28T11:01:11Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}]}